CVE-2025-12140

CriticalCVSS 9.3

Published: 27/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

34th percentile - higher than 34% of all known CVEs

Summary

The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the 'redirectUrlParameter' value. The application interprets the input string as a Java expression, allowing an unauthenticated attacker to perform arbitrary code execution. This issue was fixed in version wu#2016.1.5513#0#20251014_113353.

Risk Assessment

An unauthenticated attacker can execute arbitrary code remotely within the application context, potentially leading to full system compromise and data breach.

Recommendation

Update the application to version wu#2016.1.5513#0#20251014_113353 or later. If possible, restrict access to the application to trusted users only.

Other vulnerabilities in ALC WebCTRL

CVE-2024-5539Critical
The Access Control Bypass vulnerability in ALC WebCTRL and Carrier i-Vu up to and including version 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the web-based building automation server.

Original NVD description (English source)

The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code execution. This issue was fixed in version wu#2016.1.5513#0#20251014_113353

Vulnerability data from NVD (NIST) · CISA KEV · EPSS