---
cve: "CVE-2025-0657"
severity: "HIGH"
cvss: 8.8
epss: "0.4%"
vendor: "Carrier"
kev: false
exploited: false
published: "2025-11-27 01:00:59"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T18:13:38+01:00"
---

# CVE-2025-0657

> 8.8 HIGH

## Beschreibung

A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver
  version  drv_gen5_106-01-2380, allows
  malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to
  return the device to network visibility.

## CNA-Record (Kanon, cvelistV5)

- CNA: **Carrier**
- State: PUBLISHED
- Stand: 2025-11-28 19:34:27
- CNA-CVSS: **8.8** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-129** — Improper Validation of Array Index
  The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
- **CWE-248** — Uncaught Exception
  An exception is thrown from a function, but it is not caught.

## Angriffsmuster (CAPEC)

- [CAPEC-100 — Overflow Buffers](https://capec.mitre.org/data/definitions/100.html) _(Severity: Very High)_

## Referenzen

- <https://www.corporate.carrier.com/product-security/advisories-resources/>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2025-0657/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_