CVE-2026-25086

Published: Mar 21, 2026Modified: Jun 17, 2026

7.7

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.5 / Impact: 5.2

Source: ics-cert@hq.dhs.gov (Secondary)

Description

Under certain conditions, an attacker could bind to the same port used by WebCTRL. This could allow the attacker to craft and send malicious packets and impersonate the WebCTRL service without requiring code injection into the WebCTRL software.

Related CWEs

CWE-605

Multiple Binds to the Same Port

When multiple sockets are allowed to bind to the same port, other services on that port may be stolen or spoofed.

References (3)

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json

Source: ics-cert@hq.dhs.gov

https://www.automatedlogic.com/en/company/security-commitment/

Source: ics-cert@hq.dhs.gov

https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08

Source: ics-cert@hq.dhs.gov

Timeline

No history available yet.