CVE-2026-24060: BACnet Protocol Information Disclosure

CVE-2026-24060 Overview

CVE-2026-24060 is a cleartext transmission vulnerability [CWE-319] affecting BACnet communications in Automated Logic building automation environments. Service information, including File Start Position and File Data fields, traverses the network without encryption. An attacker positioned on the network can sniff, intercept, and modify these BACnet packets using standard tools such as Wireshark's BACnet dissector. The proprietary update protocol between WebCTRL and the programmable logic controller (PLC) is also exposed to passive capture and reverse engineering. CISA tracks this issue under advisory ICSA-26-078-08.

Critical Impact
Network-adjacent attackers can read and tamper with unencrypted BACnet traffic to extract sensitive operational data and manipulate building control logic.

Affected Products

Automated Logic WebCTRL (per CISA advisory ICSA-26-078-08)
Automated Logic PLC devices communicating via BACnet
BACnet-connected operational technology (OT) building automation systems

Discovery Timeline

2026-03-21 - CVE-2026-24060 published to NVD
2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-24060

Vulnerability Analysis

The vulnerability stems from BACnet service data being transmitted in cleartext across the operational network. BACnet, the Building Automation and Control Networks protocol, does not enforce confidentiality or integrity for the affected service messages in this deployment. Any host with network visibility to the BACnet segment can passively capture traffic and recover information that should remain restricted to authorized engineering workstations.

The captured payloads include File Start Position offsets and File Data segments used during file transfer operations. These fields expose details about firmware, configuration files, and update bundles exchanged between WebCTRL and the PLC. Because the proprietary update format also rides over the same unencrypted channel, an attacker can reconstruct the protocol and craft modified messages.

Exploitation requires only network access. The attacker does not need credentials, user interaction, or elevated privileges, which is consistent with the network attack vector and the impact to both confidentiality and integrity.

Root Cause

The root cause is missing transport-layer protection. The implementation relies on BACnet/IP without BACnet Secure Connect (BACnet/SC), TLS, or IPsec, leaving service information and file transfer payloads in cleartext. There is no message authentication code or signature on the affected messages, so modifications in transit are not detected by the receiver.

Attack Vector

An attacker on the same BACnet segment, or with the ability to reach it via routing, VPN pivot, or compromised jump host, can launch the attack. Passive sniffing yields configuration and file transfer data. Active man-in-the-middle techniques such as ARP spoofing or rogue BACnet router insertion let the attacker modify File Start Position and File Data values, corrupting firmware updates or injecting attacker-controlled content into the PLC.

No public proof-of-concept exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is published for this vulnerability. Refer to the CISA ICSA-26-078-08 Advisory and the GitHub CSAF Document for authoritative technical details.

Detection Methods for CVE-2026-24060

Indicators of Compromise

Unexpected hosts issuing BACnet AtomicWriteFile or AtomicReadFile service requests on UDP port 47808.
ARP table anomalies or duplicate MAC addresses on the BACnet VLAN suggesting man-in-the-middle activity.
BACnet broadcast traffic originating from non-controller endpoints such as laptops or virtual machines.
Unscheduled firmware or configuration file transfers between WebCTRL and PLC devices.

Detection Strategies

Deploy OT-aware network monitoring that parses BACnet (UDP/47808) and alerts on file transfer services from unauthorized sources.
Baseline expected BACnet talkers and flag any new device identifiers or MAC/IP pairings on the control network.
Correlate WebCTRL audit logs with packet capture metadata to identify file operations that were not initiated by an operator.

Monitoring Recommendations

Continuously capture BACnet traffic at segment boundaries for forensic replay and integrity verification.
Monitor switch port mirroring and span sessions for promiscuous interfaces that should not exist on the OT network.
Alert on cross-VLAN traffic between IT subnets and the BACnet segment, which can indicate pivot attempts toward the control plane.

How to Mitigate CVE-2026-24060

Immediate Actions Required

Isolate BACnet networks behind a firewall and block UDP/47808 from corporate and internet-facing zones.
Restrict WebCTRL-to-PLC traffic to a dedicated management VLAN with explicit allow-listed endpoints.
Review the Automated Logic Security Commitment page and apply the vendor's hardening guidance.
Disable unused BACnet services and remove unauthorized devices from the control segment.

Patch Information

No fixed version is listed in the current NVD entry. Consult the CISA ICSA-26-078-08 Advisory and Automated Logic for vendor remediation guidance, including any BACnet Secure Connect (BACnet/SC) upgrade paths.

Workarounds

Tunnel BACnet traffic over IPsec or a site-to-site VPN to provide confidentiality and integrity between WebCTRL and remote PLCs.
Migrate to BACnet/SC where supported to enforce TLS-protected control communications.
Enforce port security, dynamic ARP inspection, and DHCP snooping on switches serving the BACnet segment to limit man-in-the-middle opportunities.
Require multi-factor authentication and jump-host access for any engineering workstation that touches the OT network.

bash

# Example firewall rule restricting BACnet/IP to authorized hosts
iptables -A FORWARD -p udp --dport 47808 -s 10.20.30.0/24 -d 10.20.31.10 -j ACCEPT
iptables -A FORWARD -p udp --dport 47808 -j DROP