Session compromise via unvalidated redirect parameter

Open redirect in Automated Logic WebCTRL and Carrier iVu 6.0 through 9.0 allows attackers to compromise active sessions through a URL parameter. The redirect logic accepts an attacker-controlled destination without proper validation; Carrier has not disclosed the endpoint or parameter name. Exploitation requires access to the local attack surface identified by Carrier, and the documented consequence is limited to session abuse through an open-redirect and cross-site-scripting chain.