BLU-IC2/IC4 Firmware CVE-2025-12216

Exploitation requires the attacker to reach and use the device's application/package installation function on BLU-IC2 or BLU-IC4 firmware at or below 1.19.5, then install a malicious or malformed app that the device cannot subsequently uninstall, producing a persistent denial of service. Limiting/uncertain factor: the vendor vector claims PR:N (no privileges), but the description does not state whether installing an app requires authenticated management access or a specific deployment mode - if the install path is authenticated, real-world exploitation is gated by that access and the effective risk is lower than the 10.0 implies; verify the authentication requirement against the vendor advisory.

Signals conflict sharply. The vendor-supplied CVSS 4.0 base score is a maximal 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with all vulnerable- AND subsequent-system impacts High, implying a scope-changing full compromise), yet the description only concretely asserts an availability outcome: a malicious/malformed app that can be installed but not uninstalled, 'which may lead to unavailability.' The description does not substantiate the High confidentiality/integrity or the subsequent-system (SC/SI/SA:H) ratings, so the 10.0 appears to over-state impact relative to the written defect - treat it as a vendor worst-case, not confirmed broad compromise. Exploitation-likelihood signals are low and consistent with each other: EPSS is 0.22% (11th percentile), the CVE is NOT in CISA KEV, and no public POC is indicated. Exploitation status: no public exploit identified at time of analysis. The product (Azure Access BLU-IC2/BLU-IC4 access-control/intercom firmware) is a niche physical-security appliance with a small deployment footprint, further lowering real-world urgency. Net: this is a high-severity-on-paper but low-current-risk issue - patch in normal cycles for affected BLU-IC devices rather than treating it as an emergency, while verifying the true impact (availability-only vs. full compromise) and the real authentication requirement with the vendor advisory.

An attacker with access to the BLU-IC2/IC4 device's application-install mechanism uploads a malicious or malformed application package; the device accepts and installs it but provides no way to remove it. The persistent, unremovable app degrades or halts the access-control device, rendering it unavailable (a denial-of-service against the physical-access function). No public exploit code is known, and the vendor's AC:L rating suggests the install path itself is not technically difficult once reachable.