CVE-2025-0657

ALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-range

State: Published
Severity: 8.8 High
Published: Nov 27, 2025
Updated: Nov 28, 2025
Reserved: Jan 22, 2025

Description

A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv_gen5_106-01-2380, allows malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to return the device to network visibility.

Scores

CVSS	Score	Vector	Source
4.0	8.8 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N	Carrier

Weaknesses

CWE-129 Improper Validation of Array Index
CWE-248 Uncaught Exception

Affected Products

Product	Versions
WebCtrlAutomated Logic	8.5 and earlierAffected
Gen5 ControllersAutomated Logic	drv_gen5_108-04-20120 and earlierAffected
i-VuCarrier	8.5 and earlierAffected

References

https://www.corporate.carrier.com/product-security/advisories-resources/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.