BLU-IC2/IC4 Firmware CVE-2025-12284

Requires network reachability to the web management interface of a BLU-IC2 or BLU-IC4 device running firmware version 1.19.5 or earlier; per the CVSS vector no authentication (PR:N) or user interaction (UI:N) is needed. The primary limiting factor is exposure: these are access-control/intercom appliances whose web UIs are typically on internal or management networks rather than internet-facing, substantially narrowing the realistic attack surface. The description does not name a specific feature or non-default setting, so exploitation appears tied to the standard web UI rather than an optional configuration.

Signals are consistent and point to a MODERATE, low-urgency issue rather than a top priority. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, but every impact metric is only Low (VC:L/VI:L/VA:L and subsequent SC:L/SI:L/SA:L), yielding a 6.9 MEDIUM score - meaning limited, not total, compromise. EPSS strongly corroborates low real-world risk: 0.19% probability at the 9th percentile, indicating exploitation is unlikely in the near term. There is no CISA KEV listing and no known public exploit code, so this is not confirmed as actively exploited. No SSVC decision data was provided. The one tension worth flagging: the description is extremely vague ('might lead to potential exploitation'), so the Low-across-the-board impact rating cannot be independently validated and the CWE-20 (Improper Input Validation) root cause could manifest more severely than the vendor's scoring implies - verify specifics with Azure Access. Net: patch in normal cycle, not emergency.

A remote attacker with network access to a BLU-IC2 or BLU-IC4 device's web management UI submits crafted input to a field that lacks proper validation, causing the device to disclose information or behave unexpectedly. Per the CVSS vector, no authentication or user interaction is required and attack complexity is low, but the impact is limited to partial confidentiality/integrity/availability effects. No public proof-of-concept exploit is known.