CVE-2025-0658CWE-20

CVE-2025-0658

published November 27, 2025

CVSS
8.7
EPSS
0%
Percentile
25.5
In the wild
Unconfirmed
What it is

A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol

causes the device to crash. The device enters a fault state; after a reset,

a second packet can leave it permanently unresponsive until a manual power cycle

is performed.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.00333 · 25.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-11-27T06:15Z
References (1)
https://https://www.corporate.carrier.com/product-security/advisories-resources/ · [email protected]
EPSS history
Timeline
  • 27 NOV 01:00Z
    Automated Logic and Carrier Zone Controllers malformed packets denial of service
    cvelistv5