AES GCM is used
Yes, we appear to have a serious problem; just not the one you were thinking of.
In the case of GCM, nonrandom IVs are absolutely not a problem; in fact, it is common practice with AES GCM to use incrementing IVs.
However, in your scenario, there's another possible issue. GCM doesn't mind predictable IVs, but it needs IVs to be unique; if the attacker can see two different messages encrypted with the same IV, security breaks down pretty badly.
Now, it sounds like for this protocol, every identical device with have the same manufacturer-specific string. If so, then we have a serious problem here; if two different devices use the same invocation number, then we have repeated IVs, and Bad Things happen.
And, even if the manufacturer-specific string wasn't identical between different physical devices (e.g. for a given manufacturer, there was a unique device id embedded), you can still run into problems if the device reboots (and then starts back at 0 with the invocation number).
So, yes, if the situation is as you described, we have a serious problem here (just not the one you thought).
BTW: could you mention which IOT spec this was?