BLU-IC2/IC4 Firmware CVE-2025-12104

Exploitation requires network access to the BLU-IC2/IC4 device's web/UI interface running firmware at or below 1.19.5, and presupposes that a specific outdated front-end dependency bundled in that UI carries an exploitable flaw - the advisory names neither the dependency nor the triggering feature, so the exact prerequisite endpoint or configuration cannot be stated. Per the input CVSS vector (PR:N/UI:N) no authentication or user interaction is required; the practical limiting factor is reachability of the management UI, which on access-control/intercom appliances is frequently segmented to internal or restricted networks, substantially narrowing real-world exposure.

Signals conflict sharply. The input CVSS 4.0 vector is a maximal 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA:H and subsequent-system SC/SI/SA:H), implying remote, unauthenticated, no-interaction full compromise that spills into downstream systems. Against that, EPSS is only 0.41% (34th percentile), the device is NOT on CISA KEV, and no public exploit was identified. The description - 'Outdated and Vulnerable UI Dependencies might potentially lead to exploitation' (CWE-1104, use of unmaintained/vulnerable third-party components) - is generic and hedged ('might potentially'), naming no specific dependency CVE, no affected endpoint, and no concrete impact. This is a strong candidate for a high-CVSS-but-uncertain-real-risk case: the 10.0 reads as a worst-case vendor assumption rather than a demonstrated end-to-end exploit, and the all-High subsequent-system (SC/SI/SA) scores are unsupported by any detail in the description. Realistic priority is moderate and exposure-dependent: if the BLU-IC2/IC4 web UI is reachable from untrusted networks, prompt patching to 1.19.5+ is warranted, but the low EPSS and absence of KEV/POC argue against imminent mass exploitation. Verify the specific vulnerable dependency and its actual impact against the vendor advisory before treating this as a confirmed critical.

An attacker with network reach to the BLU-IC2/IC4 web management interface targets a known-vulnerable bundled UI/front-end dependency, sending crafted requests that trigger the dependency's flaw to disclose sensitive data or interfere with the device. No public proof-of-concept for this specific CVE was identified, so any attack would hinge on the (unnamed) upstream dependency vulnerability, and the generic description leaves the concrete impact unconfirmed.