---
cve: "CVE-2026-24060"
severity: "CRITICAL"
cvss: 9.1
epss: "0.2%"
vendor: "Automated Logic"
kev: false
exploited: false
published: "2026-03-21 00:16:25"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T14:23:53+01:00"
---

# CVE-2026-24060

> 9.1 CRITICAL · 🧪 PoC

## Beschreibung

Service information is not encrypted when transmitted as BACnet packets 
over the wire, and can be sniffed, intercepted, and modified by an 
attacker. Valuable information such as the File Start Position and File 
Data can be sniffed from network traffic using Wireshark's BACnet 
dissector filter. The proprietary format used by WebCTRL to receive 
updates from the PLC can also be sniffed and reverse engineered.

## CNA-Record (Kanon, cvelistV5)

- CNA: **icscert**
- State: PUBLISHED
- Stand: 2026-03-23 15:55:53
- CNA-CVSS: **9.1** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-319** — Cleartext Transmission of Sensitive Information
  The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

## Angriffsmuster (CAPEC)

- [CAPEC-65 — Sniff Application Code](https://capec.mitre.org/data/definitions/65.html) _(Severity: High)_
- [CAPEC-102 — Session Sidejacking](https://capec.mitre.org/data/definitions/102.html) _(Severity: High)_
- [CAPEC-117 — Interception](https://capec.mitre.org/data/definitions/117.html) _(Severity: Medium)_
- [CAPEC-383 — Harvesting Information via API Event Monitoring](https://capec.mitre.org/data/definitions/383.html) _(Severity: Low)_
- [CAPEC-477 — Signature Spoofing by Mixing Signed and Unsigned Content](https://capec.mitre.org/data/definitions/477.html) _(Severity: High)_

## ATT&CK-Techniken

- [T1040 — Network Sniffing](https://attack.mitre.org/techniques/T1040/)
- [T1056.004 — Input Capture: Credential API Hooking](https://attack.mitre.org/techniques/T1056/004/)

## Referenzen

- <https://www.automatedlogic.com/en/company/security-commitment/>
- <https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08>
- <https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-24060/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_