BLU-IC2 Firmware CVE-2025-12365

Exploitation requires network access to the HTTP/web management interface of a BLU-IC2 or BLU-IC4 device running firmware at or below 1.19.5, plus the ability to induce an error condition whose message the firmware then wraps into an HTTP response header. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed, but realistic risk is limited by the fact that these are specialized access-control/intercom appliances typically deployed on internal or segmented networks, so exposure depends on whether the management interface is reachable by the attacker. Impact is bounded to disclosure of sensitive information contained in error output - not direct code execution or data modification.

This is a moderate-to-low real-world priority despite a CVSS 4.0 base score of 6.9. The provided CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated flaw, which raises the nominal score, but the underlying weakness is CWE-209 (error message containing sensitive information) - an information-disclosure issue, not code execution. The input vector asserts VC:L/VI:L/VA:L (low confidentiality, integrity AND availability impact), which is inconsistent with the description and CWE: an error-message-in-HTTP-header leak realistically affects confidentiality only, so the integrity/availability impacts appear over-stated - verify against the vendor advisory. The EPSS score is low at 0.25% (15th percentile), consistent with no KEV listing and no identified public exploit, so there is no evidence of active or imminent widespread exploitation. Net: a genuine but low-severity information-disclosure bug in niche access-control hardware - patch in normal maintenance cycles rather than treating as an emergency.

A remote attacker on a network that can reach the device's web interface sends requests crafted to trigger error conditions, causing the firmware to embed internal error details into an HTTP response header. The attacker reads these leaked details (e.g., stack/path/configuration fragments) to fingerprint the device and aid further attacks. No public exploit code has been identified, and the low-complexity network vector means no special tooling beyond an HTTP client is required.