The vulnerability allows an attacker to bind to the TCP port that WebCTRL Premium Server uses, enabling them to send crafted packets that the system will accept as coming from the legitimate service. Because no code injection is required, the attacker can impersonate the WebCTRL service and potentially redirect or inject traffic to connected BACnet devices.

Affected deployments are those running Automated Logic’s WebCTRL Premium Server, especially the end‑of‑life WebCTRL 7 edition and earlier. Users of WebCTRL 8.5 cumulative releases or newer should verify that they are using the latest version, which includes secure BACnet/SC support and improved configuration guidance. If an older unsupported version is in use, the vulnerability is present.

With a CVSS score of 7.7, the flaw is considered high severity. No EPSS data or KEV listing indicates it may not yet have been exploited, yet the absence of a code‑injection requirement means an attacker only needs to reach the vulnerable port, which is feasible from any network segment with access to the device. The risk remains notable in environments where WebCTRL is exposed to untrusted networks.