Unauthenticated remote command execution affects Azure Access BLU-IC2 and BLU-IC4 firmware through version 1.19.5, where attacker-supplied input that manipulates the device's mail configuration file is later processed in a way that executes injected OS commands. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H and SC/SI/SA:H) yields a maximum 10.0 base score and matches our independent CVSS 3.1 assessment of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, meaning no credentials and no user interaction are needed - the realistic barrier is network reachability of the appliance's management/mail-configuration interface. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.54% (44th percentile), so exposure is dominated by whether these devices are internet-facing rather than by observed exploitation.
BLU-IC2 and BLU-IC4 access-control/intercom units running firmware 1.19.5 or earlier ship with a factory default password and never force the operator to replace it during initial provisioning, so anyone who can reach the management interface with the publicly known default credentials gains full administrative control of the device. The flaw is unauthenticated from the attacker's perspective (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C with high confidentiality, integrity and availability impact to both the device and connected systems) and carries a CVSS 4.0 base score of 10.0. Exploitation is not confirmed in the wild (not in CISA KEV) and no public exploit code has been identified at time of analysis, while EPSS sits at 0.34% (26th percentile) - real-world risk is driven almost entirely by whether the management interface of these specialized building-network devices is reachable from untrusted networks.