BLU-IC2/IC4 Firmware CVE-2025-12114

Exploitation requires (1) the serial console feature to be enabled on the BLU-IC2 or BLU-IC4 device, and (2) local/physical access to that serial interface (AV:L). It also depends on passive user interaction (UI:P in the vector) and carries high attack complexity (AC:H). Limiting factors: an attacker must be physically present at the device, the serial console must be active (likely a non-default or maintenance configuration rather than a remotely reachable surface), and the outcome is only disclosure of information that aids further research - not direct code execution or data compromise. These constraints make remote or scaled exploitation infeasible.

This is a genuinely low-priority issue despite a medium 5.2 CVSS 4.0 score. All signals align toward low real-world risk: the provided CVSS 4.0 vector is local (AV:L) with high attack complexity (AC:H) and requires passive user interaction (UI:P), EPSS is 0.11% (1st percentile - essentially no observed exploitation activity), there is no CISA KEV listing, and no public exploit code is referenced. The vulnerability (CWE-1191, exposed on-chip debug/serial interface) is an information-disclosure weakness that merely 'might help an attacker find vulnerabilities' - it is a reconnaissance enabler, not a direct compromise. Note a tension in the vendor vector worth verifying: it claims subsequent-system impact of SC:H/SI:H/SA:H (high) while vulnerable-system impact is only VC:L/VI:L/VA:L (low), which is unusual for a pure serial-console info leak and appears to inflate the score - the description does not substantiate high integrity/availability impact on downstream systems, so treat the subsequent-system metrics as unconfirmed. PR:N in the vector means no authentication, but AV:L means an attacker must already have local/physical access to the device's serial console, which must also be enabled.

An attacker with physical access to a BLU-IC2 or BLU-IC4 access-control device (e.g., an exposed door-entry panel) connects to its enabled serial console and reads diagnostic output, firmware details, or configuration data that reveals internal structure useful for finding further vulnerabilities. No public exploit code exists; exploitation requires local physical presence and the serial console being enabled, consistent with the AV:L/AC:H/UI:P vector.