BLU-IC2/IC4 CVE-2025-12275

Exploitation requires network reachability to the affected BLU-IC2 or BLU-IC4 firmware (versions through 1.19.5) and interaction with the device's mail configuration handling: the attacker supplies input that manipulates the mail configuration file, which is then processed in a way that executes injected OS commands. Per the CVSS vector (PR:N/UI:N), no authentication and no user interaction are required, so the primary limiting factor is network exposure of the device's management/mail-configuration interface - devices isolated on a trusted VLAN or behind a firewall are far less exposed. The exact feature endpoint and whether any non-default mail configuration must be enabled are not detailed in the available description and should be confirmed against the vendor advisory.

All severity signals point the same direction: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with high confidentiality, integrity and availability impact on both the vulnerable component (VC/VI/VA:H) and subsequent systems (SC/SI/SA:H), yielding a maximal 10.0 base score - consistent with the description's 'Mail Configuration File Manipulation + Command Execution' (effectively unauthenticated RCE). The real-world risk signals, however, temper the urgency: EPSS is only 0.54% (44th percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. This is a genuinely critical flaw by impact and attack prerequisites, but the low EPSS and absence of KEV/POC suggest it is not yet subject to widespread opportunistic exploitation - most likely a high-priority patch for the specific population that runs these devices rather than an internet-wide mass-exploitation event. Note a tagging conflict: the input Tags label this 'Information Disclosure', which contradicts the description's command-execution/config-manipulation nature - verify the true impact class with the vendor advisory. The CWE is the generic CWE-20 (Improper Input Validation), and the description is extremely terse, so the exact exploitation mechanics are not independently confirmed.

A remote, unauthenticated attacker who can reach the management interface of a BLU-IC2 or BLU-IC4 intercom/access-control device sends crafted input that manipulates the device's mail configuration file, injecting operating-system commands that the device later executes. This grants arbitrary command execution on the device, letting the attacker take over the unit and potentially the physical access-control function it governs. No public exploit code is referenced, so exploitation would currently require independent development.