What is the CVSS score of CVE-2025-12285?

CVE-2025-12285 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2025-12285?

Within 24 hours, inventory every BLU-IC2 and BLU-IC4 access-control/intercom unit, flag all devices running firmware 1.19.5 or earlier, immediately replace factory default administrative credentials on every reachable unit, and restrict management-interface access to trusted administrative networks or VPN only; no vendor-released patch is identified at time of analysis. Within 7 days, segment these devices from untrusted networks and general user VLANs, disable remote management and unnecessary services where operationally feasible, enable logging and alerting for failed logins and configuration changes, and verify that default credentials are not reused across the estate. Within 30 days, establish a firmware-update plan and apply the vendor-released patch as soon as it becomes available, revalidate access-control lists and network exposure, and conduct a targeted review of all BLU-IC2/BLU-IC4 units to confirm remediation.

BLU-IC2/IC4 Firmware CVE-2025-12285

CRITICAL

Improper Input Validation (CWE-20)

2025-10-26 a0340c66-c385-4f8b-991b-3d05f6fd5220

Information Disclosure Blu Ic2 Firmware Blu Ic4 Firmware

10.0

CVSS 4.0 · Vendor: a0340c66-c385-4f8b-991b-3d05f6fd5220

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach device management interface on network
Exploit

Authenticate with default initial credentials
Execution

Gain full administrative control
Impact

Manipulate physical access / pivot to connected systems

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions	Exploitation requires network reachability to the administrative/management interface of a BLU-IC2 or BLU-IC4 device running firmware 1.19.5 or earlier on which the initial/default password was never changed (the vulnerability is precisely that the device does not enforce this change at first setup). No valid user-supplied credentials, authentication, or user interaction are needed (PR:N/UI:N) - the known default credentials suffice. The main limiting factor is exposure: these are specialized intercom/access-control units typically deployed on internal or building networks, so risk is highest where the interface is reachable from untrusted networks or the internet, and is mitigated once an operator has manually set a strong non-default password.
Impact	The CVSS 4.0 base score of 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with high vulnerable- and subsequent-system impact VC/VI/VA:H and SC/SI/SA:H) reflects a trivially exploitable, unauthenticated flaw: the device does not force a change of its initial/default password, so anyone who can reach the management interface with known factory credentials gains full control. Weighing against the maximal CVSS, the EPSS probability is only 0.34% (26th percentile), and there is NO CISA KEV listing and NO public exploit referenced, so there is no evidence of active or widespread exploitation at this time. These signals are not strictly conflicting - default-credential issues score high on exploitability yet often show low EPSS because exploitation requires network reachability to the specific device and the affected product (Azure Access BLU-IC2/BLU-IC4 intercom/access controllers) is niche rather than internet-ubiquitous. No SSVC decision was supplied in the input, so automatable/technical-impact judgments are inferred from CVSS only. Net: a genuinely severe weakness where reachable, but likely targeted/opportunistic rather than mass-exploited given the specialized, typically internally-networked product; prioritize for any deployment whose management interface is network-accessible.
Exploit ScenarioDerived	An attacker with network access to a BLU-IC2 or BLU-IC4 unit (firmware ≤1.19.5) connects to its management interface and logs in using the unchanged factory/default credentials, because the device never required an initial password change. With full administrative access they can unlock doors, disable the access-control function, and pivot into connected building systems. No public exploit code is referenced, but no exploitation is needed beyond knowing the default credentials; the CVSS AV:N/AC:L/PR:N/UI:N vector confirms no authentication or user interaction is required.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 18, 2026

BLU-IC2 and BLU-IC4 access-control/intercom units running firmware 1.19.5 or earlier ship with a factory default password and never force the operator to replace it during initial provisioning, so anyone who can reach the management interface with the publicly known default credentials gains full administrative control of the device. The flaw is unauthenticated from the attacker's perspective (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C with high confidentiality, integrity and availability impact to both the device and connected systems) and carries a CVSS 4.0 base score of 10.0. Exploitation is not confirmed in the wild (not in CISA KEV) and no public exploit code has been identified at time of analysis, while EPSS sits at 0.34% (26th percentile) - real-world risk is driven almost entirely by whether the management interface of these specialized building-network devices is reachable from untrusted networks.

RemediationAI

No vendor-released patch with a confirmed fixed version is identified in the available data; consult https://azure-access.com/security-advisories to confirm whether firmware beyond 1.19.5 enforces a mandatory initial password change, and upgrade as soon as a fixed release is published. Until then, the single most effective action is to log in to every BLU-IC2 and BLU-IC4 device with the factory credentials and immediately set a strong, unique administrative password (and change any default service, ONVIF or SIP credentials), recording it in the organization's credential vault - this closes the vulnerability's precondition entirely, at the cost of a manual inventory-and-commissioning sweep across all sites. Complement that with network controls: place the devices on a dedicated management VLAN and restrict reachability to the web/admin interface via ACLs or firewall rules so only authorized administrative hosts can connect (trade-off: administrators lose convenient remote access and must use a jump host or VPN); block inbound access to the management port from the internet and disable WAN-side remote management where the product allows it (trade-off: remote-site maintenance requires VPN or on-site access). If the firmware supports it, enable HTTPS-only administration and centralized logging of authentication events, and alert on successful logins using default or shared credentials, since such logins are the primary detection signal for exploitation attempts. Organizations that cannot immediately rotate credentials should prioritize isolating internet-facing units first, as EPSS is low but the impact of a compromise of an access-control endpoint is full physical-security control.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected devices are embedded network appliances (CPE cpe:2.3:o:azure-access:blu-ic2_firmware and cpe:2.3:o:azure-access:blu-ic4_firmware) exposing an administrative/management service over the network; the vulnerability is that the firmware accepts factory default credentials indefinitely and provides no mandatory first-boot password rotation workflow. The assigned CWE-20 (Improper Input Validation) is a generic classification - the effective root cause is the absence of an enforced credential-change step at commissioning (closer to CWE-1392 Use of Default Credentials / CWE-1188 Initialization of a Resource with an Insecure Default), which is why the CVSS 4.0 vector shows AT:N and PR:N: no attack complexity, no authentication and no user interaction are required once the interface is reachable. Because the compromised component is a building access-control endpoint, the CVSS 4.0 subsequent-system metrics (SC:H/SI:H/SA:H) and the CVSS 3.1 scope-change rating reflect that an attacker who logs in can pivot beyond the device itself - reconfiguring intercom/door-control behavior, extracting configuration and possibly camera or credential data, and using the unit as a foothold on the internal network. The mitigating variable is exposure and operator hygiene: devices where a strong, unique administrative password was manually set at installation are effectively remediated, and units confined to segmented management VLANs present a much smaller attack surface.

Know when Blu Ic2 Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (a0340c66-c385-4f8b-991b-3d05f6fd5220) PRIMARY 10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

vuln.today AI 10.0 CRITICAL

Unenforced default password means no privileges needed (PR:N) over the network (AV:N/AC:L); full device control with scope change (S:C) since the access controller governs physical door/building systems.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (a0340c66-c385-4f8b-991b-3d05f6fd5220).

CVSS VectorVendor: a0340c66-c385-4f8b-991b-3d05f6fd5220

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

High

Subsequent system: Integrity

High

Subsequent system: Availability

High

DescriptionCVE.org

Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Executive ViewAI

Why It Matters

BLU-IC2 and BLU-IC4 access-control/intercom units running firmware 1.19.5 or earlier can be taken over by an unauthenticated attacker who reaches the management interface using factory default credentials, giving full administrative control over physical access and intercom functions. Leadership should care because a compromise could let an attacker change access permissions, disrupt building communications, or use the device as a foothold into connected building networks, especially where these interfaces are exposed beyond trusted networks. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; exposure reduction should focus on credential replacement and network access control.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: immediately change all factory default administrative credentials on BLU-IC2/BLU-IC4 firmware 1.19.5 or earlier; restrict management-interface access to trusted networks or VPN; segment devices from untrusted and general-purpose networks; disable remote management where not required; monitor authentication and configuration logs; and enforce unique strong passwords with periodic rotation.

Threat Intelligence Overview

EPSS Score

0.3%

Top 74% exploitable

Prevalence

Low

niche physical access-control/intercom hardware from a specialized vendor

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +50

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.