High severity · published Nov 27, 2025
CVE-2025-0657
ALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-range
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver
version drv_gen5_106-01-2380, allows
malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to
return the device to network visibility.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GC
Gen5 Controllers · Automated Logic
through drv_gen5_108-04-20120 · source: vendor
WE
WebCtrl · Automated Logic
through 8.5 · source: vendor
IV
i-Vu · Carrier
through 8.5 · source: vendor