BLU-IC2 and BLU-IC4 firmware through 1.19.5 fail to terminate authenticated sessions on logout, letting an attacker who obtains or reuses an un-terminated session token retain management-interface access; despite the 6.9 CVSS 4.0 score, this is a moderate, low-priority issue. Exploitation requires a pre-existing authenticated session-typically on a shared or unattended terminal or via a stolen token-so the vendor's CVSS 4.0 PR:N rating overstates reachability; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS is 0.20% (10th percentile) and no public exploit was identified at time of analysis.
Improper input validation in the web management interface of Azure Access BLU-IC2 and BLU-IC4 access-control/intercom appliances running firmware 1.19.5 and earlier lets unauthenticated remote attackers submit crafted input that yields limited confidentiality, integrity, and availability impact (CVSS 4.0 base 6.9; vendor-tagged as an information disclosure issue). Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) no credentials or user interaction are required, so exposure is governed almost entirely by whether the device's web UI is reachable - these appliances normally sit on internal or management networks rather than the public internet. Risk is moderate and low-urgency: EPSS is 0.19% (9th percentile) and no public exploit code or CISA KEV entry was identified at time of analysis.