CVE-2025-0657 ALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-range
Attackers can send malformed BACnet packets to cause Gen5 controllers to enter a fault state, requiring manual power cycling to restore network visibility.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0657?
CVE-2025-0657 is a high-severity denial of service vulnerability in Automated Logic Gen5 Controllers, published on 27 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv_gen5_106-01-2380, allows malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to return the device to network visibility.
Which versions are affected by CVE-2025-0657?
How do I fix CVE-2025-0657?
No fix has been published for CVE-2025-0657 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-0657 being exploited?
There is no known exploitation of CVE-2025-0657 in the wild and no public exploit code.
Sources
Also known as GHSA-q763-2mvp-6vvq.