Azure Access BLU-IC2 CVE-2025-12363

Exploitation requires network reachability to a BLU-IC2 or BLU-IC4 intercom running firmware 1.19.5 or earlier that has an email/SMTP account configured - the disclosed secret only exists on devices where email notification is set up, so units with no email account configured are not exposed. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, special attack requirement, or user interaction is needed, making any device whose management/notification interface is reachable by the attacker directly exploitable. The primary limiting factors are therefore network exposure of these access-control appliances (typically on segmented internal or building-automation networks rather than the public internet) and whether the email-disclosure feature is in use.

Signals conflict sharply and must be weighed carefully. The vendor-supplied CVSS 4.0 vector scores a maximal 10.0 with AV:N/AC:L/AT:N/PR:N/UI:N and full High impact on both the vulnerable system (VC/VI/VA:H) and subsequent systems (SC/SI/SA:H), implying trivially remote, unauthenticated, total compromise. However, the CWE-200 classification and the terse description ('Email Password Disclosure') describe an information-exposure flaw whose direct impact is confidentiality of stored email credentials - the full Integrity/Availability High ratings appear to be the vendor accounting for downstream pivoting (using the leaked mailbox password) rather than a direct I/A effect of the vulnerability itself, so the 10.0 likely overstates direct technical impact. Countervailing real-world signals are weak: EPSS is just 0.32% (23rd percentile), there is no CISA KEV listing and no public exploit identified, indicating no evidence of exploitation despite the perfect CVSS. Net: treat as a genuinely serious credential-disclosure bug on an internet-exposable access-control device (patchable by upgrading past 1.19.5), but prioritize below products with comparable CVSS that also carry KEV/POC/high-EPSS signals. Note explicitly: description implies a single disclosed secret while CVSS claims full CIA on two system tiers - verify the real impact scope against the vendor advisory.

An attacker with network reach to an exposed BLU-IC2/BLU-IC4 intercom (firmware ≤1.19.5) requests or reads a device endpoint that returns the configured email account password in cleartext, requiring no authentication or user interaction (AV:N/PR:N/UI:N). The attacker then logs into that email account to read mail, send spoofed messages, or reset other services tied to the address. No public proof-of-concept is identified at time of analysis, so weaponization effort is unverified.