BLU-IC2/IC4 Firmware CVE-2025-12031

Exploitation is not standalone: because the cookies lack HttpOnly, an attacker must already be able to execute JavaScript in the device's web context (i.e. an existing XSS vulnerability) to read them from the JS context; because they lack Secure, an attacker alternatively needs a network man-in-the-middle position to capture cookies transmitted over cleartext HTTP. Limiting factors: the target must be a BLU-IC2 or BLU-IC4 running firmware at or below 1.19.5, a valid authenticated session cookie must exist to steal, and the device web interface must be reachable by the attacker. The CVSS PR:L indicates some privilege/authentication context is involved rather than fully anonymous access.

This is a low-to-moderate priority issue that the raw CVSS 4.0 score of 5.3 (MEDIUM) slightly overstates. The vulnerability is CWE-1004 - sensitive cookies issued by BLU-IC2/BLU-IC4 firmware (through 1.19.5) lacking the HttpOnly and Secure attributes - which is a contributing/enabling weakness, not a directly exploitable code-execution flaw. Exploitation signals are weak: EPSS is 0.21% (10th percentile), there is no CISA KEV listing, and no public exploit has been identified, so this is neither actively exploited nor broadly weaponizable. The provided CVSS 4.0 vector (AV:N/AC:L/PR:L with low impact across VC/VI/VA and subsequent-system SC/SI/SA) appears inflated for a cookie-attribute weakness: integrity and availability impact (VI:L/VA:L) and subsequent-system impacts are hard to justify for missing HttpOnly/Secure flags, which realistically affect only confidentiality and only once a secondary condition is met (an XSS payload to read the cookie from the JavaScript context, or a network man-in-the-middle position to capture a cookie sent over cleartext HTTP). No SSVC decision data was provided. Net: a genuine hardening defect worth patching on these access-control devices, but not an urgent, standalone remote-compromise risk. Verify the inflated I/A metrics with the vendor advisory.

An attacker who already has a cross-site scripting foothold in the BLU-IC2/IC4 web interface, or who can intercept cleartext HTTP traffic to the device, reads a session cookie that was issued without HttpOnly/Secure protection. The stolen cookie is then replayed to hijack the authenticated session of a device operator. No public proof-of-concept exists; real impact depends on a second, enabling vulnerability or a MITM position.