What’s Vulnerable › Vulnerabilities
CVE-2025-0658: Automated Logic and Carrier Zone Controllers malformed packets denial of service
- Severity: high (CVSS 8.7 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-11-27 · updated 2026-10-18
- Weakness: CWE-20
Description
A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol causes the device to crash. The device enters a fault state; after a reset, a second packet can leave it permanently unresponsive until a manual power cycle is performed.
Affected products
- Automated Logic Zone Controllers: before 6.06-101 — fixed in 6.06-101
- Carrier Zone Controllers: before 6.06-101 — fixed in 6.06-101
How to fix
Upgrade to a fixed version: Automated Logic Zone Controllers 6.06-101; Carrier Zone Controllers 6.06-101. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-0658 or the next vulnerability affects your stack