BLU-IC2/IC4 CVE-2025-12364

The device must expose a network-reachable authentication/management interface for the BLU-IC2 or BLU-IC4 intercom access controller (firmware version 1.19.5 or earlier), and the weak password policy must have allowed a weak, short, default, or guessable credential to be set - exploitation is credential-guessing/brute-force against that account rather than a deterministic code-execution bug. Limiting factors: success is contingent on an actually-weak password being present (strong unique passwords largely neutralize it), on the attacker reaching the auth interface (devices behind segmented/VPN-only management networks are far less exposed), and potentially on the absence of account lockout/rate-limiting; authentication is required to reach the high-impact actions despite the vector being network-facing.

Signals conflict sharply and must be weighed carefully. The input assigns a maximal CVSS 4.0 base score of 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with High vulnerable- AND subsequent-system impact across C/I/A), which on its face implies trivial remote unauthenticated total compromise. However, the underlying weakness is CWE-521 (Weak Password Policy) - a configuration/credential-strength weakness that enables brute-force or credential guessing rather than a direct memory-corruption or injection primitive. A 10.0/PR:N rating for a weak-password-policy issue is unusually aggressive: realistically the attack still requires reaching the authentication interface and succeeding against guessable/weak credentials, which is better modeled with higher attack complexity than the vendor assigned. Counter-balancing the high CVSS, EPSS is only 0.34% (26th percentile), there is no CISA KEV listing (no confirmed active exploitation), and no public exploit code is referenced - all of which indicate this is not currently a widespread, automated-exploitation event. Net: treat as a genuine design flaw warranting prompt patching on these access-control devices because the impact ceiling (physical door/access control takeover) is severe, but the '10.0' should not be read as evidence of easy, imminent mass exploitation; the low EPSS and absence of KEV/POC argue against emergency priority relative to products under active attack. Note the vendor CVSS claims a scope/subsequent-system change (SC:H/SI:H/SA:H) - plausible for an access controller that governs downstream physical systems, but this is a vendor assertion not independently verified here.

An attacker with network reachability to a BLU-IC2 or BLU-IC4 device (firmware ≤1.19.5) targets the authentication interface and, because the weak password policy permits short/default/guessable credentials, conducts automated credential guessing or brute-force to obtain administrative access. Once authenticated, the attacker controls the access-control/intercom device - potentially unlocking doors or pivoting to connected systems. No public exploit code is referenced, and success depends on weak credentials actually being in use.