BLU-IC2/IC4 CVE-2025-12278

Exploitation requires that a user previously authenticated to the BLU-IC2/BLU-IC4 management interface and then logged out, after which the session remains valid; the attacker must therefore acquire or reuse that un-terminated session token (e.g., on a shared/kiosk terminal, an unattended browser, or via a sniffed/stolen token). This is what LIMITS the flaw: it is not exploitable against a user who never logged in, and it does not grant fresh credentials - it only prolongs an existing session. The vendor CVSS claim of PR:N overstates reachability because a pre-existing authenticated session is a de facto prerequisite. Affected only on firmware versions through 1.19.5.

This is a moderate, low-priority issue despite the 6.9 (Medium) CVSS 4.0 score. The vendor vector (AV:N/AC:L/PR:N/UI:N with Low confidentiality/integrity/availability impact to both vulnerable and subsequent systems) paints a network-reachable, unauthenticated, low-complexity flaw, but the description - 'Logout Functionality not Working' - describes a session-invalidation failure (sessions remain valid after logout, effectively CWE-613 rather than the assigned CWE-20). That creates a real conflict: the PR:N rating implies no credentials are needed, yet exploiting a non-terminating session inherently requires access to a session that was already authenticated (a captured token or a shared/kiosk device), so practical exploitation is NOT truly 'unauthenticated' - verify the attack preconditions with the vendor. Supporting signals all point to low real-world urgency: EPSS is 0.20% (10th percentile), there is no CISA KEV listing, and no public exploit code is referenced. No SSVC decision data was provided. Net: a genuine but narrow session-management weakness in a niche access-control product - worth patching in maintenance, not an emergency.

A user logs into the BLU-IC2/IC4 web/management interface and clicks logout, but the session token is never invalidated server-side. An attacker who can obtain or reuse that still-valid session - for example on a shared workstation, kiosk, or via a captured token - regains authenticated access to the intercom/access-control device without re-authenticating. No public exploit code is identified at time of analysis.