BLU-IC2/IC4 Firmware CVE-2025-12218

Requires (1) network reachability to a BLU-IC2 or BLU-IC4 device running firmware 1.19.5 or earlier, and (2) the device still using the weak/unchanged factory-default credentials that this CWE-1392 issue concerns. No user interaction, no legitimate account, and no non-default feature toggle are needed - the credentials are effectively public knowledge, so exploitation is unauthenticated in practice. The primary limiting factor is operator remediation: if an administrator has already changed the default credentials, the device is not exploitable via this vector. Exposure is further limited where these access-control appliances sit on isolated/segmented networks rather than being internet-facing.

Signals conflict sharply. The CVSS 4.0 base score is a maximal 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA:H and subsequent-system SC/SI/SA:H), describing trivial, network-reachable, unauthenticated full compromise via CWE-1392 weak default credentials - the kind of flaw that is effort-free to exploit once a device is reachable and its factory credentials are unchanged. Against that, exploitation-probability signals are low: EPSS is only 0.30% (21st percentile), the CVE is NOT in CISA KEV, and no public POC is referenced. This divergence (max CVSS but low EPSS, no KEV, no POC) suggests the real-world risk is gated by exposure and population, not by exploit difficulty: BLU-IC2/BLU-IC4 are niche Azure Access door-entry/access-control appliances typically deployed on internal or segmented networks, so the AV:N 'network' vector often does not translate into direct internet exposure. Bottom line: this is a genuine priority for any organization actually running these devices with default credentials, but it is not a mass-exploitation event - it reads as a high-severity, low-prevalence issue warranting prompt credential rotation rather than emergency-patch panic. Note the vendor is 'Azure Access' (an access-control hardware maker), NOT Microsoft Azure - do not conflate.

An attacker who can reach a BLU-IC2 or BLU-IC4 device over the network authenticates using the documented weak factory-default credentials, needing no prior privileges and no user interaction. Because those credentials grant administrative control, the attacker fully compromises the device - able to manipulate access-control/door functions and pivot into the connected network. No public exploit code is identified at time of analysis; exploitation requires only knowledge of the default credentials and network reachability to an unremediated device.