Unauthenticated remote command execution affects Azure Access BLU-IC2 and BLU-IC4 firmware through version 1.19.5, where attacker-supplied input that manipulates the device's mail configuration file is later processed in a way that executes injected OS commands. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H and SC/SI/SA:H) yields a maximum 10.0 base score and matches our independent CVSS 3.1 assessment of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, meaning no credentials and no user interaction are needed - the realistic barrier is network reachability of the appliance's management/mail-configuration interface. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.54% (44th percentile), so exposure is dominated by whether these devices are internet-facing rather than by observed exploitation.
BLU-IC2 and BLU-IC4 access-control/intercom units running firmware 1.19.5 or earlier ship with a factory default password and never force the operator to replace it during initial provisioning, so anyone who can reach the management interface with the publicly known default credentials gains full administrative control of the device. The flaw is unauthenticated from the attacker's perspective (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C with high confidentiality, integrity and availability impact to both the device and connected systems) and carries a CVSS 4.0 base score of 10.0. Exploitation is not confirmed in the wild (not in CISA KEV) and no public exploit code has been identified at time of analysis, while EPSS sits at 0.34% (26th percentile) - real-world risk is driven almost entirely by whether the management interface of these specialized building-network devices is reachable from untrusted networks.
SQL injection in langgraph-checkpoint-sqlite 2.0.10 allows attacker-controlled values passed to the store's filter operators ($eq, $ne, $gt, $lt, $gte, $lte) to be concatenated directly into SQL statements, letting a query escape its intended filter and return every document in the store - including sensitive fields such as passwords and API keys. Exploitation requires a local attack vector with low privileges (CVSS 7.3, AV:L/PR:L/UI:N/S:C), so risk is gated on whether the deploying application exposes filter inputs to untrusted users and whether it is still running the vulnerable 2.0.10 release. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, making this a moderate, context-dependent risk rather than an emergency.
BLU-IC2 and BLU-IC4 firmware through 1.19.5 fail to terminate authenticated sessions on logout, letting an attacker who obtains or reuses an un-terminated session token retain management-interface access; despite the 6.9 CVSS 4.0 score, this is a moderate, low-priority issue. Exploitation requires a pre-existing authenticated session-typically on a shared or unattended terminal or via a stolen token-so the vendor's CVSS 4.0 PR:N rating overstates reachability; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS is 0.20% (10th percentile) and no public exploit was identified at time of analysis.
Improper input validation in the web management interface of Azure Access BLU-IC2 and BLU-IC4 access-control/intercom appliances running firmware 1.19.5 and earlier lets unauthenticated remote attackers submit crafted input that yields limited confidentiality, integrity, and availability impact (CVSS 4.0 base 6.9; vendor-tagged as an information disclosure issue). Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) no credentials or user interaction are required, so exposure is governed almost entirely by whether the device's web UI is reachable - these appliances normally sit on internal or management networks rather than the public internet. Risk is moderate and low-urgency: EPSS is 0.19% (9th percentile) and no public exploit code or CISA KEV entry was identified at time of analysis.