CVE-2025-14295: WebCTRL Password Storage Vulnerability

CVE-2025-14295 Overview

CVE-2025-14295 is a credential storage flaw affecting Automated Logic WebCTRL and Carrier i-Vu building management systems on Windows. The web session management component stores user passwords in a recoverable format rather than using a one-way cryptographic hash. An attacker with local access to the host can retrieve these credentials in plaintext or reversible form. Recovered passwords enable credential reuse attacks against other systems where users have reused the same password. The issue is tracked as CWE-257: Storing Passwords in a Recoverable Format and affects WebCTRL and i-Vu versions 6.0 through 9.0.

Critical Impact
An attacker with local access to WebCTRL or i-Vu hosts can recover stored user passwords and pivot to other accounts and systems through credential reuse.

Affected Products

Automated Logic WebCTRL on Windows, versions 6.0 through 9.0
Carrier i-Vu on Windows, versions 6.0 through 9.0
Web session management component in both products

Discovery Timeline

2026-01-22 - CVE-2025-14295 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-14295

Vulnerability Analysis

The vulnerability lies in how the web session management component of WebCTRL and i-Vu persists user authentication secrets. Instead of storing salted, one-way hashes such as bcrypt, scrypt, or Argon2, the application retains passwords in a reversible format. This means anyone who can read the relevant storage location on the Windows host can convert the stored value back into the original cleartext password.

Both WebCTRL and i-Vu are building automation platforms commonly deployed in commercial real estate, hospitals, and industrial facilities. Operator accounts often share credentials with broader enterprise systems, including Active Directory, vendor remote-access portals, and engineering workstations. Recovered credentials therefore extend the impact well beyond the building management system itself.

Exploitation requires local access and meets specific preconditions, which is reflected in the CVSS 4.0 vector with AV:L and AC:H. However, scope changes to SC:H indicate that successful exploitation impacts confidentiality of resources beyond the vulnerable component.

Root Cause

The root cause is a design decision to keep passwords in a recoverable format inside the web session management subsystem. Reversible storage is occasionally used to support legacy authentication protocols or password retrieval features, but it violates the secure storage principle that passwords must only be verified, never retrieved. Any administrator, service account, or attacker with read access to the storage backend can derive the original secret.

Attack Vector

An attacker first obtains local access to the Windows server running WebCTRL or i-Vu. This may occur through stolen technician credentials, a compromised contractor workstation, or lateral movement from another system on the operational technology network. Once local, the attacker locates the password store used by the web session management component and applies the known reversal routine to extract cleartext credentials. The attacker then attempts those credentials against corporate single sign-on, VPN, email, or other building automation servers in classic credential reuse attacks.

No verified public exploit code is available for CVE-2025-14295. Refer to the Carrier Security Advisory for vendor technical details.

Detection Methods for CVE-2025-14295

Indicators of Compromise

Unexpected file access on WebCTRL or i-Vu installation directories, particularly under the web session and user database paths
Successful logins from WebCTRL or i-Vu accounts to unrelated enterprise systems such as VPN, email, or Active Directory
New interactive or remote logons on the WebCTRL or i-Vu host outside of normal maintenance windows
Process executions reading WebCTRL or i-Vu data files using tools like powershell.exe, certutil.exe, or archive utilities

Detection Strategies

Monitor file read access to WebCTRL and i-Vu data directories and alert on access by non-service accounts
Correlate authentication events across the building automation system and enterprise identity providers to detect credential reuse
Baseline expected processes on the WebCTRL or i-Vu server and alert on deviations, especially scripting interpreters and archivers

Monitoring Recommendations

Enable Windows object access auditing on the WebCTRL and i-Vu installation folders
Forward Windows Security and Sysmon logs from the server to a centralized SIEM for correlation
Track logons that use accounts shared between the building management system and other enterprise services

How to Mitigate CVE-2025-14295

Immediate Actions Required

Apply the vendor-supplied fix once available by consulting the Carrier Security Advisory page for the latest WebCTRL and i-Vu releases
Force a password reset for every WebCTRL and i-Vu account and prohibit reuse of any previously stored password
Restrict local and remote administrative access to the Windows host running WebCTRL or i-Vu to a minimal set of named operators
Audit other enterprise systems for accounts that share passwords with WebCTRL or i-Vu users

Patch Information

Carrier publishes product security updates through its product security advisories portal. Administrators running WebCTRL or i-Vu versions 6.0 through 9.0 should review the portal for the fixed release that addresses CVE-2025-14295 and follow the documented upgrade path. Validate the upgrade in a staging environment before deploying to production controllers, and confirm that the post-upgrade password store no longer permits credential recovery.

Workarounds

Isolate WebCTRL and i-Vu servers on a segmented operational technology network with no direct internet exposure
Restrict file system permissions on WebCTRL and i-Vu data directories to the service account only
Require multi-factor authentication on any enterprise account that has historically shared a password with a WebCTRL or i-Vu user
Enforce unique, randomly generated passwords for every WebCTRL and i-Vu account through an enterprise password manager

bash

# Configuration example: restrict access to WebCTRL data directory on Windows
icacls "C:\WebCTRL\webroot\WEB-INF\data" /inheritance:r
icacls "C:\WebCTRL\webroot\WEB-INF\data" /grant:r "WebCTRLService:(OI)(CI)F"
icacls "C:\WebCTRL\webroot\WEB-INF\data" /grant:r "Administrators:(OI)(CI)F"

# Enable object access auditing
auditpol /set /subcategory:"File System" /success:enable /failure:enable