Exploit discussion active in current signal (3 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the File Start Position and File Data can be sniffed from network traffic using Wireshark's BACnet dissector filter. The proprietary format used by WebCTRL to receive updates from the PLC can also be sniffed and reverse engineered.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-03-20 | 1 | Disclosure1 |
| 2026-03-21 | 3 | Disclosure2General1 |
CVE-2026-24060 Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable inform… https://www.cve.org/CVERecord?id=CVE-2026-24060
Post summary
The CVE highlights a lack of encryption for BACnet transmitted data, allowing potential interception and tampering, but no PoC, exploit, or patch details are provided.
[CVE-2026-24060: CRITICAL] Unencrypted BACnet packets pose a serious threat. Valuable data vulnerable to interception such as File Start Position and File Data can be exposed, risking cyber attacks.#cve,CVE-2026-24060,#cybersecurity https://cvefind.com/CVE-2026-24060
Post summary
The tweet announces the critical CVE‑2026‑24060, outlining that unencrypted BACnet packets can expose key file data, but it provides no PoC, exploit, patch, or evidence of active attacks.
🔴 CVE-2026-24060 - Critical Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the Fil... https://www.thehackerwire.com/vulnerability/CVE-2026-24060/ https://t.co/JVRFpqwDDG
Post summary
The post discloses that CVE-2026-24060 allows attackers to sniff, intercept, and modify unencrypted BACnet traffic, highlighting a confidentiality flaw.
🚨 CVE-2026-24060: Automated Logic WebCTRL Premium ... BACnet packets flowing in cleartext means every HVAC command, sensor reading, and PLC update is trivially sniffable—cri... https://zerodaysignal.com/vulnerability/CVE-2026-24060 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE-2026-24060, revealing that BACnet traffic is transmitted in cleartext, allowing trivial sniffing, and provides a link to more details.