CVE-2025-14295 Automated Logic WebCTRL and Carrier i-Vu Session Fixation
Attackers can recover stored passwords from WebCTRL and i-Vu systems, enabling credential reuse and unauthorized access to building automation controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-14295?
CVE-2025-14295 is a high-severity vulnerability in Automated Logic WebCTRL, published on 22 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Format vulnerability (CWE-257) in the Web session management component allows an attacker to access stored passwords in a recoverable format which makes them subject to password reuse attacks by malicious users.This issue affects WebCTRL: from 6.0 through 9.0; i-Vu: from 6.0 through 9.0.
Weakness: CWE-257
Which versions are affected by CVE-2025-14295?
How do I fix CVE-2025-14295?
No fix has been published for CVE-2025-14295 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-14295 being exploited?
There is no known exploitation of CVE-2025-14295 in the wild and no public exploit code.
Sources
Also known as GHSA-x8wr-8gvh-9cmf.