Azure Access BLU-IC2 CVE-2025-12221

Exploitation is limited to BLU-IC2 and BLU-IC4 devices running firmware through 1.19.5 that bundle the outdated BusyBox 1.31.1 userland. Per the CVSS 4.0 vector, the attacker must already hold low-privilege authentication (PR:L), a specific non-default attack requirement must be satisfied (AT:P), and passive user interaction is needed (UI:P) - meaning this is not reachable by an unauthenticated attacker against a default configuration. The vendor advisory does not enumerate which specific BusyBox known vulnerabilities apply, so the exact triggering feature/utility is unconfirmed; the aggregate impact is characterized as low across confidentiality, integrity, and availability.

This is a low-priority issue across nearly all signals. The vendor CVSS 4.0 base score is 2.1 (Low), and every impact metric is only Low (VC:L/VI:L/VA:L, subsequent SC:L/SI:L/SA:L). EPSS is 0.17% (5th percentile), indicating very low statistical probability of exploitation. There is no CISA KEV listing and no public exploit identified, so active-exploitation and weaponization signals are absent. The CVSS 4.0 vector reinforces limited real risk: although AV:N (network) raises theoretical reach, AT:P (a specific attack requirement must hold), PR:L (attacker must already be authenticated with low privileges), and UI:P (passive user interaction) together make opportunistic or automated exploitation unlikely. The underlying issue is categorized as CWE-16 (Configuration) and is described vaguely as 'Busybox 1.31.1 - Multiple Known Vulnerabilities' bundled in BLU-IC2/BLU-IC4 firmware - a composition/outdated-component problem rather than a single sharply-defined flaw. Note a data gap: the description aggregates multiple unspecified BusyBox CVEs without enumerating them, so the single low CVSS score may understate or overstate any individual bundled bug; verify specifics against the vendor advisory. Overall this reads as a genuinely low-risk, low-severity hygiene issue, not a high-CVSS-but-low-real-risk mismatch.

An attacker with existing low-privilege authenticated access to a BLU-IC2 or BLU-IC4 intercom/access-control device leverages a known, unpatched BusyBox 1.31.1 utility flaw, combined with a specific required condition and passive user interaction, to obtain limited disclosure of information or minor integrity/availability effects. No public exploit code is identified at time of analysis, and success depends on preconditions not present in every deployment.