BLU-IC2 Firmware CVE-2025-12001

Exploitation requires the ability to introduce an unsanitized application manifest into the BLU-IC2/BLU-IC4 firmware (through 1.19.5) and a subsequent victim - typically an administrator or operator of the device's web interface - rendering that stored content, at which point the injected script executes in their session. The key LIMITING factors are: (1) the attacker needs a path to store/submit a manifest, which generally implies some access to the management function rather than purely anonymous reach, and (2) the payload only fires when a user views the affected page. Despite the input vector asserting PR:N/UI:N, the stored-XSS mechanism strongly implies at least some privilege to store the manifest and user interaction to trigger it; this should be confirmed against the vendor advisory.

Signals conflict sharply and the vendor-supplied CVSS 4.0 of 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H) should be treated with skepticism. The underlying weakness is a STORED cross-site scripting flaw (CWE-20, missing application-manifest sanitation), which realistically yields browser-context script execution against users who view the malicious manifest - not the unauthenticated, full confidentiality/integrity/availability system compromise that a 10.0 'all-High' vector implies. A stored XSS almost always requires (a) some means to submit/store the manifest and (b) a victim rendering it, which contradicts the PR:N/UI:N claimed in the input; this discrepancy should be verified with the vendor. Supporting signals point to LOW real-world urgency: EPSS is 0.19% (9th percentile), there is no CISA KEV listing, and no public exploit code is referenced. Net assessment: this is a high-CVSS-but-likely-overstated issue for most environments - a legitimate bug to patch, but the numeric 10.0 overstates real-world risk given the XSS nature, low EPSS, absence of KEV/POC, and the niche deployment footprint of the affected door-entry hardware.

An attacker able to supply or influence an application manifest on a BLU-IC2/BLU-IC4 device embeds malicious JavaScript that is stored without sanitation. When an administrator or operator later views the affected management interface, the script executes in their browser session, potentially hijacking the session or altering displayed data. No public exploit code is referenced, and successful exploitation depends on a privileged user viewing the injected content.