The vulnerability allows attackers to intercept BACnet service traffic transmitted by WebCTRL Premium Server without encryption. Sensitive data, including file offsets and file contents, can be captured and modified using standard network tools. This permits disclosure of proprietary update formats and other confidential information, potentially compromising the integrity of downstream PLC updates. The weakness corresponds to CWE‑319, cleartext transmission of sensitive information.

All installations of Automated Logic WebCTRL Premium Server are affected, particularly those running WebCTRL 7 and earlier, as WebCTRL 7 has reached end of life. Subsequent versions such as WebCTRL 8.5 cumulative releases and later have been updated to support encrypted BACnet/SC, but if these updated versions are not deployed, the vulnerability remains.

The vulnerability scores 9.1 on the CVSS v3.1 scale, indicating a high risk to confidentiality. The EPSS value is not provided, and the vulnerability is not listed in the CISA KEV catalog, but SANS guidelines caution that cleartext protocol traffic is a serious threat. Attackers likely need network visibility to the BACnet segment and can achieve exploitation by passively sniffing packets or actively modifying traffic; no authentication or privilege escalation is required. Because BACnet is a field bus protocol used in industrial control systems, the potential impact spans from data leakage to compromised security updates.