CVE-2024-5539

CriticalCVSS 9.2/10Last modified Jun 17, 2026

Description

The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the

web based building automation server.

Metrics

CVSS 4.0 9.2/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Nov 27, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-553986.54C Strategies Exonaut before v22.4 was discovered to contain insecure permissions.CVE-2024-553996.54C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF).CVE-2024-55406.9The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allo CVE-2024-554016.5An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal.CVE-2024-554025.34C Strategies Exonaut before v22.4 was discovered to contain an access control issue.CVE-2024-554077.8An issue in the DeviceloControl function of ITE Tech. Inc ITE IO Access v1.0.0.0 allows attackers to perform arbitrary port read and write a CVE-2024-554085.3An improper access control vulnerability in the AsusSAIO.sys driver may lead to the misuse of software functionality utilizing the driver wh CVE-2024-55415.3The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c CVE-2024-554118.8An issue in the snxpcamd.sys component of SUNIX Multi I/O Card v10.1.0.0 allows attackers to perform arbitrary read and write actions via su CVE-2024-554127.8A vulnerability exits in driver snxpsamd.sys in SUNIX Serial Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbi CVE-2024-554137.8A vulnerability exits in driver snxppamd.sys in SUNIX Parallel Driver x64 - 10.1.0.0, which allows low-privileged users to read and write ar CVE-2024-554149.8A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping phys