CVE-2025-0658: Automated Logic Zone Controllers

High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days.

A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol causes the device to crash. The device enters a fault state; after a reset, a second packet can leave it permanently unresponsive until a manual power cycle is performed.

Affected products

• Automated Logic Zone Controllers: before 6.06-101 (fixed in 6.06-101)
• Carrier Zone Controllers: before 6.06-101 (fixed in 6.06-101)

Published 2025-11-27. Last modified 2026-06-17.