BLU-IC2/IC4 Firmware CVE-2025-11925

The affected API returns responses with Content-Type text/html instead of application/json, so a browser will parse and execute attacker-influenced HTML/JavaScript contained in the reply (an output Content-Type / injection flaw in BLU-IC2 and BLU-IC4 firmware versions up to and including 1.19.5). Exploitation requires an attacker to reach the vulnerable endpoint and to get a victim to render the crafted response in a browser; the resulting impact is script execution in the victim's browser session against the device web context, not direct code execution on the firmware. Limiting factors: realistic exploitation hinges on victim interaction (loading the crafted response) and on network reachability of the device's web API, which in access-control deployments is often restricted to management networks.

Signals conflict sharply here. The CNA-assigned CVSS 4.0 vector rates this 10.0 (AV:N/AC:L/PR:N/UI:N with VC/VI/VA and SC/SI/SA all High), implying unauthenticated remote total compromise. That is inconsistent with the actual flaw described: an API returns an incorrect Content-Type (text/html instead of application/json), allowing a browser to render attacker-influenced HTML/JavaScript in the reply - classic reflected cross-site-scripting behavior, not direct device takeover. Real XSS normally requires a victim to view the response (user interaction) and yields browser-context script execution with limited impact, which contradicts the UI:N and all-High impact metrics in the input vector; the 10.0 appears inflated. Corroborating this, EPSS is only 0.26% (16th percentile), there is no CISA KEV listing, and no public exploit is identified - so there is no public exploit identified at time of analysis. CWE-754 (improper check for unusual/exceptional conditions) is also an odd fit for what reads as an output-encoding/XSS issue. Net: treat as a moderate-severity XSS-class web flaw in access-control appliances, not a wormable 10.0; prioritize patching reachable/internet-exposed devices but the headline score overstates real-world risk.

An attacker crafts a request to the affected API endpoint so the response embeds HTML/JavaScript; because the device returns it as text/html, a victim who loads that response in a browser executes the attacker's script in the device's web context, enabling session theft or actions against the intercom's management interface. No public exploit code is known, and exploitation realistically depends on luring an authenticated operator to the crafted response. Impact is script execution in the victim's browser session rather than direct firmware code execution.