|2017-08-31||Other||Automated Logic Corporation (ALC)||Evgeny Ermakov from Kaspersky Lab has identified the vulnerability.
# Automated Logic Corporation ALC WebCTRL, Liebert SiteScan, Carrier i-VU
### VULNERABLE VENDOR
Automated Logic Corporation (ALC)
### VULNERABLE PRODUCT
ALC WebCTRL, Liebert SiteScan, Carrier i-VU
Evgeny Ermakov from Kaspersky Lab has identified the vulnerability.
### AFFECTED PRODUCTS
The following ALC web-based building automation applications are affected:
Liebert SiteScan Web Version 6.5, and prior;
ALC WebCTRL Version 6.5, and prior; and
Carrier i-Vu Version 6.5, and prior.
The vulnerability, if exploited, could lead to the disclosure of confidential data, denial of service (DoS), spoofing of a request from an upstream device, port scanning from the perspective of the machine where the parser is located, and other system impacts.
Impact to individual organizations depends on many factors that are unique to each organization, including but not limited to whether the application was installed and is maintained in accordance with manufacturer's recommendations. Risk of impact is significantly lower for those systems installed and maintained as set forth in ALC's system installation and maintenance guidelines.
### VULNERABILITY OVERVIEW
IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE ('XXE') CWE-611
An attacker could enter malicious input to WebCTRL, i-Vu, or SiteScan Web through a weakly configured XML parser causing the application to execute arbitrary code or disclose file contents from a server or connected network.
CVE-2016-5795 has been assigned to this vulnerability.
A CVSS v3 base score of 6.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Critical Infrastructure Sector: Commercial Facilities
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Kennesaw, Georgia
ALC applications should always be installed and maintained in accordance with the guidelines found here:
In addition, ALC has released the following patches:
WebCTRL 6.0, Cumulative Patch #11.
WebCTRL 6.1, Cumulative Patch #4.
WebCTRL 6.5, Cumulative Patch #5.
These patch releases may be obtained on the Automated Logic accounts web site or calling Technical Support at 770-429-3002:
i-Vu 6.0, Cumulative Patch #11.
i-Vu 6.5, Cumulative Patch #5.
These patch releases may be obtained by calling Technical Support at 800-277-9852: