BLU-IC2/IC4 Firmware CVE-2025-12220

Exploitation requires network reachability to a BLU-IC2 or BLU-IC4 device running vulnerable firmware (through 1.19.5), which embeds the outdated BusyBox 1.31.1 userland; the attacker must reach whatever network-facing service or applet exposes the underlying BusyBox weakness. The description does not name the specific vulnerable applet, protocol, or configuration, so the exact triggering service is unconfirmed. Practical limiting factors: these are specialized access-control/intercom appliances typically deployed on segmented internal or physical-security networks, which constrains internet-wide exposure; realistic risk therefore hinges on whether the affected device service is actually reachable from an attacker's network position. Per CVSS no authentication or user interaction is required (PR:N/UI:N).

Signals conflict sharply here. The supplied CVSS 4.0 base score is a maximal 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with full VC/VI/VA and subsequent-system SC/SI/SA all High), implying trivial remote unauthenticated compromise with cascading impact. However, EPSS is only 0.37% (29th percentile), there is no CISA KEV listing, and no public exploit is referenced - so there is no evidence of real-world exploitation despite the perfect score. The description is also an aggregate placeholder ('Busybox 1.31.1 - Multiple Known Vulnerabilities'), meaning the 10.0 appears to be an umbrella rating for an outdated bundled component rather than a single verified full-chain RCE; the only technique tag is 'Information Disclosure', which does not by itself justify VI:H/VA:H and especially the subsequent-system (SC/SI/SA:H) metrics - those appear inflated and should be verified with the vendor. CWE is N/A and no individual BusyBox CVE is enumerated, so the true impact is unconfirmed. Net: treat as a genuine patch-management concern (end-of-life/old BusyBox in access-control firmware) but not a confirmed widespread-exploitation emergency - the low EPSS and absence of KEV/POC argue against the 10.0 reflecting imminent mass exploitation. Prioritize based on network exposure of the devices rather than on the raw score alone.

An attacker with network reachability to a BLU-IC2 or BLU-IC4 access-control device (firmware ≤1.19.5) identifies that it ships the outdated BusyBox 1.31.1 and targets one of the publicly documented BusyBox vulnerabilities in an exposed service or applet to disclose sensitive data or interfere with device operation. No CVE-specific proof-of-concept is referenced, though generic public exploit information for older BusyBox versions is widely available. Realistic reach depends on whether the device's affected service is exposed beyond an isolated physical-security network.