Automated Logic / Carrier i-Vu Gen5 BACnet router (drv_gen5_106-01-2380) and i-Vu Zone Controller: Malformed BACnet

Impact

Malformed BACnet MS/TP frames put the router and the zone controllers into a fault state, and the vendor is explicit that recovery requires a manual power cycle - on the zone controller a second packet after reset leaves it permanently unresponsive until someone physically touches it. That is the important operator detail: this is not a reboot-and-recover DoS, it is a bricking-until-truck-roll DoS against the devices that command air handling in the hall. Lose the zone controllers and the affected zone stops modulating; depending on the failsafe wiring you either get fans stuck at last-known state or dampers closed. Either way you have lost closed-loop thermal control over a GPU hall and you are now running on whatever the mechanical failsafe does, with a technician on the way. For a 40 kW+ rack density that is a race you can lose. Expect this to hit during the worst possible moment because an attacker will fire it while the plant is already at high load.

Who can reach it

An attacker on the BACnet MS/TP segment, or on any BACnet/IP segment that routes onto it. MS/TP is an RS-485 serial bus, so pure MS/TP access means physical proximity to the field wiring - but the Gen5 router exists precisely to bridge IP to MS/TP, and that is the exposed side. Anyone who can send BACnet/IP to the router can reach the serial devices behind it. On the facility VLAN this needs no credentials because BACnet has no authentication to begin with.

What to do

Driver/firmware update from Automated Logic or Carrier for the Gen5 router and controllers. Realistically this means the controls contractor on site with a laptop touching every controller, during a maintenance window, on live cooling - which is exactly the work most operators defer. Because the fix is slow, the compensating control is the one that matters: no arbitrary host should be able to originate BACnet/IP toward the router. Put the BACnet segment behind an allow-list at the switch or a firewall that permits only the BMS supervisor's address, and disable BACnet routing between building zones that do not need to talk. If you lease, you cannot flash the landlord's controllers - get the driver version in writing and require them to schedule it.

References