Attacks on AES-128 (ECB) based on some knowledge of plaintext
If the protocol doesn't provide authentication, an attacker can probably mount replay attacks or make deterministic changes to messages.

If the nonces in different blocks are not compared in any way, they can just take the ID block of a previous message and use it with a new one, to forge it being from that device. If nonces are required e.g. to be equal in all the blocks of a message, the attacker can still reorder them freely, which reorders the message in the same way. If there are any blocks without nonce, those can be freely moved within and between messages.


  One of the plaintext blocks it encrypts has a 4-octet nonce followed by 12-octets that are always the same (part of the device's unique ID).


A 32-bit nonce means you need to see on average $2^{16}$ such blocks from the same ID + key to see a collision. Even seeing just a few hundred gives an attacker a larger chance to see one than is usually considered secure. Such a collision shows the attacker the two messages came from the same device/ID.


  I'm looking for basically anything that could compromise the security of the protocol, so anything that significantly narrows down the keyspace, or even the possible values for those 12 constant octets.


You cannot find the key even with known plain/ciphertext pairs (unless it's been chosen in a non-random way that allows an attack). If the attacker ever sees two blocks with equal ciphertext, they will know the plaintexts are equal and may be able to derive information about the ID, depending on which block matched which.