Skip to content
OpenAdvisories
High · 8.8 CVE-2025-0657 EUVD-2025-199779GHSA-q763-2mvp-6vvq

ALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-range

Published Nov 27, 2025 · Updated Nov 28, 2025 · Assigned by Carrier

Description

A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver
version drv_gen5_106-01-2380, allows
malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to
return the device to network visibility.

Affected products

VendorProductAffectedFixed
Automated Logic WebCtrl ≤ 8.5 —
Automated Logic Gen5 Controllers ≤ drv_gen5_108-04-20120 —
Carrier i-Vu ≤ 8.5 —

References