Improper input validation in Automated Logic Zone Controllers
CVE-2025-0658
A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol causes the device to crash. The device enters a fault state; after a reset, a second packet can leave it permanently unresponsive until a manual power cycle is performed.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.003 (25.0th percentile) — read the EPSS interpretation.
Affected products
- Automated Logic Zone Controllers — versions 0
- Carrier Zone Controllers — versions 0