Product Security Advisories
Mission Statement: Carrier endeavors to ensure that validation, analysis, and mitigation of findings are proactively communicated in a responsible manner. The Carrier PSIRT Plan prepares and discloses product security advisory publications to acknowledge the reporters, vulnerabilities, impacts, and mitigations of the reported incidents.
NOTICE: PHP2Shell: Critical Vulnerabilities in PHP:
Carrier is aware of CVE-2026-109618 and CVE-2026-109619 affecting PHP and is evaluating potential impact across its product portfolio. Where Carrier products are determined to be affected, applicable product security advisories and remediation information will be published through the appropriate Carrier security channels. For updates, please see advisory CARR-PSA-2026-02.
| Advisory ID | CVE Record | ICSA Record | Affected Product | Summary | Published | Updated |
|---|---|---|---|---|---|---|
| CARR-PSA-2026-02 | CVE-2026-109618, CVE-2026-109619 | Not applicable | Refer to Advisory | PHP2Shell: Critical Vulnerabilities in PHP | October 26, 2026 | October 27, 2026 |
| CARR-PSA-2026-01 | CVE-2026-25086, CVE-2026-32666, CVE-2026-24060 | ICSA-26-078-08 | Automated Logic WebCTRL® Software 7.0 | Multiple security vulnerabilities have been identified in Automated Logic WebCTRL® Premium Server 7.0, which reached End-of-Life (EOL) on 27 January 2023 | April 27 2026 | April 27, 2026 |
| CARR-PSA-2025-07 | CVE-2025-14295 | Not Applicable | Automated Logic WebCTRL, Carrier i-Vu | Storing Passwords in a Recoverable Format | January 20, 2026 | January 20, 2026 |
| CARR-PSA-2025-03 | CVE-2024-5539 CVE-2024-5540 | Not Applicable | Automated Logic WebCTRL, Carrier i-Vu | Incorrect Authorization, Improper Neutralization of Input | ||
| CARR-PSA-2025-05 | CVE-2025-0657 | Not Applicable | Automated Logic WebCTRL, Carrier i-Vu | Improper Validation, Uncaught Exception | November 26, 2025 | November 26, 2025 |
| CARR-PSA-2025-06 | CVE-2025-0658 | Not Applicable | Automated Logic and Carrier Zone Controllers | Improper Input Validation | November 26, 2025 | November 26, 2025 |
| CARR-PSA-2025-04 | CVE-2024-8527, CVE-2024-8528 | ICSA-25-324-01 | Automated Logic WebCTRL, Carrier i-Vu | Open Redirect, Improper Neutralization of Input | November 18, 2025 | November 18, 2025 |
| CARR-PSA-2025-02 | CVE-2025-9494 CVE-2025-9495 | ICSA-25-266-04 | Vitogate 300 | Viessmann Vitogate 300 vulnerabilities | September 22, 2025 | September 22, 2025 |
| CARR-PSA-2025-01 | CVE-2024-10930 | ICSA-25-063-01 | Carrier Block Load | Uncontrolled Search Path Element vulnerability | March 4, 2025 | March 4, 2025 |
| CARR-PSA-2024-04 | CVE-2024-8525CVE-2024-8526 | ICSA-24-326-01 | Automated Logic WebCTRL & Carrier i-Vu | Unrestricted File Upload and Open Redirect vulnerabilities | November 21, 2024 | November 21, 2024 |
| CARR-PSA-2024-03 | CVE-2023-5222CVE-2023-5702CVE-2023-45852 | ICSA-24-254-01 | Viessmann Vitogate 300 | Viessmann Vitogate 300 vulnerabilities | September 10, 2024 | September 10, 2024 |
| CARR-PSA-013-0623 | Not Applicable | Not Applicable | Carrier Global Product Security Advisory | Progress Software MOVEit vulnerabilities | June 26, 2023 | June 26, 2023 |
| CARR-PSA-010-0123 | Not Applicable | Not Applicable | Carrier Global Product Security Advisory | Apache Shiro authentication bypass vulnerabilities | Jan 20, 2023 | Jan 20, 2023 |
| CARR-PSA-008-1122 | Not Applicable | Not Applicable | Carrier Global Product Security Advisory | OpenSSL 3.0 vulnerabilities | Nov 4, 2022 | Nov 4, 2022 |
| CARR-PSA-007-1122 | Not Applicable | Not Applicable | Carrier Global Product Security Advisory | Text4Shell Remote code execution vulnerability | Nov 4, 2022 | Dec 16, 2022 |
| CARR-PSA-005-0422 | Not Applicable | Not Applicable | Carrier Global Product Security Advisory | Spring4Shell Remote code execution vulnerability | April 7, 2022 | April 7, 2022 |
| CARR-PSA-004-0322 | Not Applicable | Not Applicable | Carrier Global Product Security Advisory | Okta - Lapsus$ Compromise summary | March 30, 2022 | April 7, 2022 |
| CARR-PSA-003-1221 | Not Applicable | Not Applicable | Carrier Global Product Security Advisory | Log4j Remote code execution vulnerabilities | Dec 20, 2021 | Jan 20, 2022 |
| CARR-PSA-002-1121 | CVE-2022-1318CVE-2022-26519 | ICSA-22-109-01 | Hills ComNav | Weak authentication and communication channel vulnerabilities | Nov 1, 2021 | April 19, 2022 |
| CARR-PSA-001-1121 | CVE-2022-1019 | ICSA-22-109-02 | Automated Logic WebCTRL & Carrier i-Vu | Open redirect vulnerability | Nov 1, 2021 | April 19, 2022 |