Azure Access BLU-IC2/IC4
CVE-2025-11832
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device over network
-
ExploitSend unthrottled request flood
-
ExecutionExhaust device resources
-
ImpactDeny access-control service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the BLU-IC2/BLU-IC4 device's listening service and the ability to send a sustained volume of requests; per CVSS PR:N/UI:N/AC:L no authentication, user interaction, or special configuration is needed against default deployments. The practical limiting factor is network exposure: these are physical access-control/intercom appliances typically installed on internal or segmented building-security networks, so reachability depends on whether the device is exposed to the attacker's network segment or the internet. Impact is loss of device availability (door/intercom service), not data theft, unless the vendor's claimed confidentiality/integrity impact is confirmed. |
| Impact | Signals conflict sharply here. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H and SC:H/SI:H/SA:H) yields a maximal 10.0 and implies full compromise of confidentiality, integrity, and availability on both the vulnerable and subsequent systems. However, the vulnerability class is CWE-770 (Allocation of Resources Without Limits or Throttling) and the described impact is 'Flooding' - a resource-exhaustion / denial-of-service condition that normally affects availability only. The high confidentiality and integrity impact claimed in the vector is not supported by the description and appears inflated; treat the 10.0 as vendor-assigned and likely overstated for a pure flooding bug. Corroborating the lower real-world urgency: EPSS is only 0.37% (29th percentile), there is no CISA KEV listing, and no public POC is referenced - so no public exploit identified at time of analysis. Net: this is best prioritized as a network-reachable unauthenticated DoS against niche physical-access-control hardware, not a confirmed full-compromise emergency. Verify the true impact scope with the vendor advisory before accepting the CIA-high rating. |
| Exploit ScenarioDerived | An attacker with network reachability to a BLU-IC2 or BLU-IC4 access-control device (firmware ≤1.19.5) sends a high volume of unauthenticated requests that the device allocates resources for without throttling, exhausting memory, connections, or CPU. The device becomes unresponsive, potentially disrupting door-access or intercom functionality. No public exploit code is identified at this time; exploitation is low-complexity given AC:L and requires no authentication (PR:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
Denial-of-service conditions in Azure Access Technology BLU-IC2 and BLU-IC4 firmware through 1.19.5 allow remote attackers to exhaust device resources by sending sustained request floods, potentially making physical access-control and intercom services unavailable. NVD's CVSS 4.0 vector scores this 10.0 with high confidentiality, integrity, and availability impact, but the independent assessment finds only availability impact (CVSS 3.1 7.5), so confidentiality and integrity effects should be treated as unconfirmed. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.37% (29th percentile).
RemediationAI
No vendor-released patch with an exact fixed version was identified at time of analysis; the data lists affected firmware through 1.19.5 for both BLU-IC2 and BLU-IC4 but does not specify a remediated release, so administrators should monitor https://azure-access.com/security-advisories and apply vendor-provided fixed firmware as soon as it is published. Until a fix is available, reduce exposure by placing the appliances behind a firewall or IPS with per-source connection and request-rate limits, restricting the device's listening services to trusted management or building-security VLANs, and blocking unnecessary inbound access from user networks or the internet. These controls have trade-offs: segmentation can limit legitimate remote administration and intercom integrations, and aggressive rate limiting may affect normal client traffic, so thresholds should be tuned and tested. Disable any unused network services on the devices where operationally possible, and monitor for request floods, session-table exhaustion, or unexpected reboots that indicate resource exhaustion.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is CWE-770, Allocation of Resources Without Limits or Throttling. The affected products are firmware for BLU-IC2 and BLU-IC4 building access-control/intercom appliances, identified by CPEs cpe:2.3:o:azure-access:blu-ic2_firmware:*:*:*:*:*:*:*:* and cpe:2.3:o:azure-access:blu-ic4_firmware:*:*:*:*:*:*:*:*. A network-facing service on these devices accepts requests without effective per-client rate limits, connection caps, or resource quotas, so a sustained flood can consume CPU, memory, session-table entries, or bandwidth and degrade or stop the device's availability. The CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N, meaning no authentication, user interaction, or special attack conditions are required against a reachable default deployment; however, the practical exposure depends on whether the appliance is reachable from the attacker's network segment or the internet, since these devices are typically installed on internal building-security networks. The independent assessment constrains impact to availability loss, not data theft or manipulation, unless vendor evidence confirms the broader confidentiality and integrity claims in the NVD vector.
Know when Blu Ic2 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable, low-complexity, unauthenticated flooding (CWE-770) causing resource exhaustion; impact is availability only, so C:N/I:N/A:H and no scope change evidenced.
Primary rating from Vendor (a0340c66-c385-4f8b-991b-3d05f6fd5220).
CVSS VectorVendor: a0340c66-c385-4f8b-991b-3d05f6fd5220
DescriptionCVE.org
Allocation of Resources Without Limits or Throttling vulnerability in Azure Access Technology BLU-IC2, Azure Access Technology BLU-IC4 allows Flooding.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Executive ViewAI
Azure Access Technology BLU-IC2 and BLU-IC4 firmware through 1.19.5 contain a denial-of-service vulnerability that can exhaust device resources and make physical access-control and intercom services unavailable. Facilities and security operations teams relying on these devices should care because sustained outages could disrupt building entry, communications, and safety workflows. No public exploit identified at time of analysis, and independent assessment confirms only availability impact.
Network segmentation and ACLs to trusted management networks; rate-limiting or IPS filtering for request floods; restrict management access to authorized administrators; continuous monitoring and alerting for resource exhaustion; documented manual fallback procedures for physical access and intercom services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Blu Ic2 Firmware
View allUnauthenticated remote command execution affects Azure Access BLU-IC2 and BLU-IC4 firmware through version 1.19.5, where
Arbitrary file write via path traversal in the firmware upgrade feature of Azure Access BLU-IC2 and BLU-IC4 boards (firm
Outdated third-party UI dependencies in BLU-IC2 and BLU-IC4 firmware through 1.19.5 can expose the management web interf
Network-reachable BLU-IC2 and BLU-IC4 devices running firmware through 1.19.5 embed BusyBox 1.31.1 and are exposed to mu
Azure Access OS firmware through 1.19.5 on BLU-IC2 and BLU-IC4 physical access controllers contains unspecified vulnerab
Unauthenticated remote attackers can retrieve server version information from Azure Access BLU-IC2 and BLU-IC4 physical
Unauthenticated remote access to a critical function in Azure Access BLU-IC2/IC4 firmware through 1.19.5 lets a network
Local privilege escalation in Azure Access BLU-IC2 and BLU-IC4 intercom firmware through 1.19.5 allows a lower-privilege
Weak password policy in Azure Access BLU-IC2 and BLU-IC4 intercom access controller firmware through version 1.19.5 can
BLU-IC2 and BLU-IC4 access-control/intercom units running firmware 1.19.5 or earlier ship with a factory default passwor
BLU-IC2 and BLU-IC4 firmware through 1.19.5 contain undocumented administrative accounts that allow network-reachable at
Denial of service in Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5 allows unauthenticated network attackers w
GitHub PoC
Exploit-DB