BLU-IC2/BLU-IC4 CVE-2025-12217

Requires that SNMP be enabled on the BLU-IC2/BLU-IC4 device with the factory default community string 'public' still configured, and that the attacker can reach the SNMP service (UDP/161) over the network. Affected firmware is BLU-IC2 and BLU-IC4 up to and including 1.19.5. Limiting factors: exploitation fails if an administrator has changed the community string from the default, if SNMP is disabled, or if the SNMP port is firewalled/segmented away from attacker-reachable networks - common hardening for building-access appliances. Impact is also bounded to what the 'public' community exposes (information disclosure, conventionally read-only).

This is a genuine but modest-severity exposure, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated condition - consistent with a default SNMP community string ('public') that any attacker who can reach UDP/161 already knows. However, every impact metric is rated Low (VC:L/VI:L/VA:L and subsequent SC:L/SI:L/SA:L), which caps the base score at 6.9 (Medium). The corroborating signals point to low real-world urgency: EPSS is only 0.30% (21st percentile), there is no CISA KEV listing, and no public exploit code is referenced. These signals are internally consistent - a low-impact information-disclosure flaw in a niche access-control appliance is exactly the kind of issue that stays off mass-exploitation lists. One point worth verifying: a default 'public' community string is conventionally read-only, which squares with the Information Disclosure tag and an information-exposure CWE, yet the vendor's vector also claims Integrity and Availability impact (VI:L/VA:L) - this implies either a read-write community or SNMP SET access. That discrepancy between 'default public (typically read-only)' and the claimed I/A impact should be confirmed with the vendor advisory before treating write/modification as realistic.

An attacker with network access to a BLU-IC2 or BLU-IC4 controller sends SNMP GET requests using the well-known default community string 'public' and enumerates device and configuration information without any credentials. No public exploit code is identified, but the technique requires only standard tooling (e.g. snmpwalk), so exploitation is trivial for anyone who can route to UDP/161. If the community string permits SNMP writes, the attacker could additionally alter device parameters.