Azure Access OS
CVE-2025-12219
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach controller over network
-
DeliveryTarget vulnerable component in Azure Access OS
-
ExploitExploit unauthenticated flaw
-
ExecutionGain control of access controller
-
ImpactManipulate door access or disclose data
Vulnerability Assessment
| Exploitation Conditions | The description states only 'Vulnerable Components in Azure Access OS' and names no specific feature, protocol, configuration setting, or deployment mode - the exact prerequisite is not disclosed in the available data and must be confirmed via the vendor advisory. Per the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), exploitation requires no authentication, no user interaction, and low complexity against default-reachable BLU-IC2/BLU-IC4 devices on firmware through 1.19.5. The principal limiting factor is exposure: these are specialized physical-access controllers that are typically deployed on internal or segmented building-management networks rather than the public internet, which materially narrows realistic attack surface despite the AV:N rating. |
| Impact | The input assigns a maximal CVSS 4.0 base score of 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with High vulnerable-system and subsequent-system impact across C/I/A), which on paper describes a remote, unauthenticated, low-complexity total compromise. However, the other intelligence signals contradict this severity: EPSS is only 0.37% (29th percentile), there is no CISA KEV listing, and no public exploit is identified. The result is a classic high-CVSS-but-currently-low-real-risk profile. A further red flag is that the description ('Vulnerable Components in Azure Access OS') is a generic third-party/dependency bucket with no CWE and no named component, protocol, or sink - the 10.0 appears to be a worst-case vendor/aggregator assignment rather than a vector derived from analyzed root cause. This should be verified with the vendor advisory before treating the full 10.0 as confirmed. Net: a genuine patch priority for the small population that operates BLU-IC2/BLU-IC4 physical-access controllers, but not a broad emergency given niche deployment and no evidence of exploitation. |
| Exploit ScenarioDerived | A remote attacker with network reach to a BLU-IC2 or BLU-IC4 access controller running Azure Access OS ≤1.19.5 sends traffic to the exposed, unpatched vulnerable component and, per the CVSS vector, achieves unauthenticated compromise without user interaction. Because these are physical-access/door controllers, a successful compromise could translate into unauthorized door control or disclosure of access data. No public exploit code is identified at time of analysis, so this scenario is theoretical pending vendor detail on the actual component. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
Azure Access OS firmware through 1.19.5 on BLU-IC2 and BLU-IC4 physical access controllers contains unspecified vulnerable components that expose the devices to a maximum-severity network attack. The supplied CVSS 4.0 vector (10.0) describes a remote, unauthenticated, low-complexity compromise with high confidentiality, integrity, and availability impact on both the vulnerable device and subsequent systems, although the exact vulnerable feature and prerequisites are not disclosed and these controllers are typically confined to internal building-management networks. No public exploit was identified at time of analysis and EPSS is 0.37% (29th percentile), so near-term exploitation likelihood is assessed as low despite the critical score.
RemediationAI
No vendor-released patch or fixed version is identified in the supplied data, so confirm update availability at https://azure-access.com/security-advisories and apply the vendor's fixed firmware as soon as it is published. Until then, place BLU-IC2 and BLU-IC4 controllers on a dedicated access-control VLAN, block inbound traffic from user networks and the internet, and allow management only from a restricted administrative jump host; these controls reduce exposure but complicate central management and remote support. Disable unused management services and monitor controller logs for anomalous access if the device supports it; disabling services can break integrations and must be validated in a lab first.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Azure Access OS is embedded software for BLU-IC2 and BLU-IC4 access-control hardware; the CPE entries azure-access:blu-ic2_firmware and azure-access:blu-ic4_firmware confirm that the issue is in device firmware rather than a separate application. The advisory describes 'Vulnerable Components' but does not identify the affected library, protocol, or service, and no CWE is assigned, so the precise root-cause class cannot be determined from the supplied data. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) indicates a network-reachable flaw requiring no authentication or user interaction and capable of affecting subsequent systems; the 'Information Disclosure' tag is narrower than the vector's stated confidentiality, integrity, and availability impact. EPSS 0.37% (29th percentile) and the absence of a public exploit signal suggest low observed exploitation activity.
Know when Blu Ic2 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Mirrors the vendor's network/unauthenticated/full-impact vector with S:C for the stated subsequent-system impact; confidence is limited because the vulnerable component and root cause are unspecified.
Primary rating from Vendor (a0340c66-c385-4f8b-991b-3d05f6fd5220).
CVSS VectorVendor: a0340c66-c385-4f8b-991b-3d05f6fd5220
DescriptionCVE.org
Vulnerable Components in Azure Access OS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Executive ViewAI
Azure Access OS firmware through 1.19.5 on BLU-IC2 and BLU-IC4 physical access controllers carries a maximum-severity risk to building-access operations because a successful network compromise could disrupt access control and affect connected systems. No public exploit was identified at time of analysis, and the low EPSS suggests near-term exploitation is unlikely, but leadership should care because these controllers often sit in trusted internal building-management networks and a compromise could affect facility security and availability.
No vendor-released patch identified at time of analysis; isolate BLU-IC2 and BLU-IC4 controllers running Azure Access OS firmware through 1.19.5 on dedicated VLANs, restrict inbound and outbound access to required management hosts, disable unnecessary services and remote access, monitor logs for anomalous activity, and enforce least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
More in Blu Ic2 Firmware
View allUnauthenticated remote command execution affects Azure Access BLU-IC2 and BLU-IC4 firmware through version 1.19.5, where
Arbitrary file write via path traversal in the firmware upgrade feature of Azure Access BLU-IC2 and BLU-IC4 boards (firm
Outdated third-party UI dependencies in BLU-IC2 and BLU-IC4 firmware through 1.19.5 can expose the management web interf
Network-reachable BLU-IC2 and BLU-IC4 devices running firmware through 1.19.5 embed BusyBox 1.31.1 and are exposed to mu
Denial-of-service conditions in Azure Access Technology BLU-IC2 and BLU-IC4 firmware through 1.19.5 allow remote attacke
Unauthenticated remote attackers can retrieve server version information from Azure Access BLU-IC2 and BLU-IC4 physical
Unauthenticated remote access to a critical function in Azure Access BLU-IC2/IC4 firmware through 1.19.5 lets a network
Local privilege escalation in Azure Access BLU-IC2 and BLU-IC4 intercom firmware through 1.19.5 allows a lower-privilege
Weak password policy in Azure Access BLU-IC2 and BLU-IC4 intercom access controller firmware through version 1.19.5 can
BLU-IC2 and BLU-IC4 access-control/intercom units running firmware 1.19.5 or earlier ship with a factory default passwor
BLU-IC2 and BLU-IC4 firmware through 1.19.5 contain undocumented administrative accounts that allow network-reachable at
Denial of service in Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5 allows unauthenticated network attackers w
GitHub PoC
Exploit-DB