BLU-IC2/IC4 Firmware CVE-2025-12176

The exploitation prerequisite is simply running BLU-IC2 or BLU-IC4 firmware version 1.19.5 or earlier, in which undocumented administrative accounts are present by default - no non-default configuration, no user interaction, and per the CVSS vector (PR:N) no legitimate authentication is required. The practical limiting factors are: the attacker must have network (or management-interface) reachability to the terminal, and must know the undocumented account credentials/mechanism, which are not published in the available data; the flaw is confined to these two specific Azure Access product lines, so blast radius is bounded by how many such terminals are deployed and network-exposed.

This is a genuinely high-priority flaw despite mixed signals. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 10.0 with full high impact on both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H), consistent with CWE-1242 (inclusion of undocumented/hidden functionality) - undocumented administrative accounts constitute an effective backdoor granting complete device takeover without authentication. However, the EPSS score is low at 0.34% (26th percentile), and there is NO CISA KEV listing and NO public POC, so widespread automated exploitation is not currently indicated. The low EPSS likely reflects the niche, physically-deployed nature of these access-control terminals rather than low severity - exploitation requires knowledge of the undocumented accounts, which may not yet be public. CONFLICT TO NOTE: CVSS asserts AV:N/PR:N (remote, unauthenticated), but the description only states accounts 'were getting created to facilitate access for applications running on board' and does not explicitly confirm these accounts are reachable over the network versus local/on-board inter-process use - verify network reachability of the management interface with the vendor advisory. Treat as high priority for the specific affected product given the maximal technical impact, while recognizing exploitation is likely targeted rather than mass-scanned.

An attacker with network access to a BLU-IC2 or BLU-IC4 access-control terminal running firmware ≤1.19.5 authenticates using the undocumented administrative account present in the firmware, bypassing normal authentication entirely. With full administrative control they can unlock doors, alter access logs, disable the device, or pivot to on-board applications and connected infrastructure. No public exploit code has been identified at time of analysis, but the backdoor requires no crafted payload - only knowledge of the hidden credentials.