Automated Logic WebCTRL up to 9.0 on Windows password recoverable

Summaryinfo

A vulnerability was found in Automated Logic WebCTRL up to 9.0 on Windows. It has been classified as problematic. Affected is an unknown function. This manipulation causes password recoverable. The identification of this vulnerability is CVE-2025-14295. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in Automated Logic WebCTRL up to 9.0 on Windows and classified as problematic. Affected by this vulnerability is an unknown code block. The manipulation with an unknown input leads to a password recoverable vulnerability. The CWE definition for the vulnerability is CWE-257. The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts. As an impact it is known to affect confidentiality. The summary by CVE is:

Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Format vulnerability (CWE-257) in the Web session management component allows an attacker to access stored passwords in a recoverable format which makes them subject to password reuse attacks by malicious users.This issue affects WebCTRL: from 6.0 through 9.0; i-Vu: from 6.0 through 9.0.

It is possible to read the advisory at corporate.carrier.com. This vulnerability is known as CVE-2025-14295 since 12/08/2025. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-4155). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• Automated Logic

Name

• WebCTRL

Version

• 9.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion