Vulnerability in Automated Logic and Carrier Zone Controller Affected by BACnet Protocol
CVE-2025-0658

8.7HIGH

Key Information:

Vendor: Automated Logic
Status: Zone Controllers
Vendor: CVE Published:; 27 November 2025

🔔 Create Automated Logic Vulnerability Alert

What is CVE-2025-0658?

A security flaw exists in Automated Logic and Carrier's Zone Controller that can be triggered through the BACnet protocol. When exploited, this vulnerability may cause the device to crash and enter a fault state. If the device is reset, it may become unresponsive after receiving a second packet, necessitating a manual power cycle to restore functionality. This poses a significant concern for operational integrity and availability.

Affected Version(s)

Zone Controllers 0 < 6.06-101

References

https://https://www.corporate.carrier.com/product-securit...

CVSS V4

Score:

8.7

Severity:

HIGH

Confidentiality:

None

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 27, 2025
Vulnerability Reserved
Jan 22, 2025

Credit

Christopher Morales Gonzalez

CVE-2025-0658 Data

JSON