Initialization vector based on data which can be changed by an attacker
The communication between the device and the software can be
  intercepted and changed by the attacker.


Because of this, you really should use authenticated encryption (e.g. CCM).


  Is it wrong to send a randomly generated value from the software to
  the device, hash it using SHA-256, and use that for the initialization
  vector?


For CBC, the IV needs to be unpredictable to an attacker. Hashing an attacker-known values doesn't make this value unpredictable, however if you encrypt the the value sent to your device using your AES engine, this value would be unpredictable and thus suitable as an IV for CBC.
Note though: CCM doesn't require an unpredictable IV and thus a simple (monotonic) counter would do, as long as the IV / nonce isn't re-used for the same key on either side.