CVE-2025-14295: WebCTRL/i-Vu Password Storage Vulnerability

CVE-2025-14295 Overview

CVE-2025-14295 is a Storing Passwords in a Recoverable Format vulnerability (CWE-257) affecting Automated Logic WebCTRL and Carrier i-Vu building automation systems on Windows. The vulnerability exists in the Web session management component, allowing attackers with local access to retrieve stored passwords in a recoverable format. This weakness exposes credentials to password reuse attacks, potentially compromising building automation systems and connected infrastructure.

Critical Impact

Attackers can access stored passwords in recoverable format, enabling credential theft and password reuse attacks against building automation systems that control HVAC, lighting, and other critical building infrastructure.

Affected Products

• Automated Logic WebCTRL versions 6.0 through 9.0 on Windows
• Carrier i-Vu versions 6.0 through 9.0 on Windows

Discovery Timeline

• 2026-01-22 - CVE CVE-2025-14295 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2025-14295

Vulnerability Analysis

This vulnerability stems from insecure password storage practices within the Web session management component of both WebCTRL and i-Vu building automation platforms. Rather than using one-way hashing algorithms or other irreversible cryptographic storage methods, the affected systems store user credentials in a format that can be reversed or decoded to obtain the original plaintext passwords.

The local attack vector requires an attacker to have some level of access to the Windows system where the application is installed. However, the attack complexity is high and requires precise conditions to be met for successful exploitation. Once an attacker gains access to the stored credentials, they can leverage the recovered passwords for unauthorized access to the building automation system or attempt password reuse attacks against other systems where the same credentials may be in use.

Building automation systems like WebCTRL and i-Vu are particularly sensitive targets as they control critical building infrastructure including HVAC systems, lighting controls, and energy management systems. Compromise of these systems could lead to operational disruption, energy waste, or even safety concerns in critical facilities.

Root Cause

The root cause of this vulnerability is the improper implementation of password storage mechanisms in the Web session management component. Instead of using secure one-way cryptographic hashing algorithms (such as bcrypt, scrypt, or Argon2) combined with proper salting, the application stores passwords in a recoverable format. This violates fundamental security principles for credential storage as defined by CWE-257 (Storing Passwords in a Recoverable Format).

Attack Vector

The attack requires local access to the Windows system running the affected WebCTRL or i-Vu software. An attacker with access to the file system or memory of the target system can locate and extract the stored password data. Due to the recoverable format, the attacker can then decode or decrypt these credentials to obtain plaintext passwords.

The attack scenario typically involves:

1. Gaining local access to the Windows system hosting WebCTRL or i-Vu through physical access, remote desktop, or initial compromise through another vector
2. Locating the password storage mechanism within the application's configuration files, database, or memory
3. Extracting the stored credentials in their recoverable format
4. Decoding or reversing the storage mechanism to recover plaintext passwords
5. Using recovered credentials for unauthorized system access or attempting password reuse against other systems

Detection Methods for CVE-2025-14295

Indicators of Compromise

• Unusual access patterns to WebCTRL or i-Vu configuration files or database files
• Unexpected file system access to directories containing credential storage
• Anomalous user authentication events, particularly successful logins from unusual locations or times
• Evidence of credential dumping tools or techniques on the Windows host

Detection Strategies

• Monitor file access to WebCTRL and i-Vu installation directories for unauthorized read operations
• Implement endpoint detection and response (EDR) solutions to detect credential harvesting activities
• Enable Windows Security auditing for object access on sensitive application directories
• Deploy SentinelOne Singularity Platform to detect and prevent credential theft attempts and lateral movement

Monitoring Recommendations

• Configure centralized logging for all authentication events on building automation systems
• Establish baseline access patterns for WebCTRL and i-Vu administrative interfaces
• Monitor for password reuse attempts across the enterprise following any suspected credential exposure
• Implement network segmentation monitoring to detect unauthorized access attempts to building automation networks

How to Mitigate CVE-2025-14295

Immediate Actions Required

• Review the Carrier Security Advisory for official patch information and remediation guidance
• Restrict local access to Windows systems hosting WebCTRL and i-Vu to only authorized administrators
• Audit user accounts and rotate passwords for all accounts stored within the affected applications
• Implement strong network segmentation to isolate building automation systems from general enterprise networks
• Monitor for suspicious authentication activity that may indicate credential misuse

Patch Information

Administrators should consult the official Carrier Security Advisory for specific patch information and updated software versions that address this vulnerability. Contact Automated Logic or Carrier support for guidance on upgrading affected installations of WebCTRL and i-Vu to patched versions.

Workarounds

• Implement strict access controls on the Windows systems hosting the affected applications
• Use Windows file system permissions to restrict access to application directories containing credential data
• Deploy additional authentication layers such as multi-factor authentication (MFA) for administrative access
• Consider network-level restrictions to limit access to the building automation management interfaces
• Ensure unique passwords are used for building automation systems to mitigate password reuse attack risks

# Example Windows file permission hardening for application directories
# Restrict access to application installation directory
icacls "C:\Program Files\WebCTRL" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" /grant:r "Administrators:(OI)(CI)F"

# Enable auditing on sensitive directories
auditpol /set /subcategory:"File System" /success:enable /failure:enable