Is there a generic attack on encrypted CRC32 when used as a MAC?
Well, 32 bits is somewhat short, so one could just try ciphertexts.

However, there is a much better attack.

Choose M0 arbitrarily, let P be the CBC padding for Headers || CRC || M0,

and choose M1 so that CRC( M0 || P || M1 )  =  CRC(M0).

Submit M0 || P || M1 to be encrypted, truncate the ciphertext to the length of

encryptions of M0, and then output the result. $\:$ That will be a valid encryption of M0.

Even without chosen plaintext, one should be able to change the headers.

Let H be the headers and let CL be the first 16 bits of CRC and let  L be the (bit-)length of Data.

Choose 48 bits X which are not all zero so that the CRC of [X combined with L zero bits

however the protocol does that] ends with the same 16 bits as the CRC of 48+L zero bits.

Xor the IV with [X concatenated with [the xor of the first 16 bits of the two just-mentioned CRCs.

By the affineness of CRC, the result will be a valid ciphertext

with the same Data and header H xor X.