BLU-IC2/IC4 Firmware CVE-2025-12422

Exploitation targets the device's firmware 'Upgrade Feature' on BLU-IC2 and BLU-IC4 boards running firmware up to and including 1.19.5; the concrete prerequisite is the ability to submit an upgrade package/request whose file path performs directory traversal (CWE-22) to write to an arbitrary location. The vendor vector states no authentication, user interaction, or special attack requirements (PR:N/UI:N/AT:N) against network-reachable devices, implying default configurations are affected. Limiting factors to assess: upgrade functionality is typically an administrative feature that may in practice require authentication or management-network access, and the device must be network-reachable to the attacker - devices on isolated/segmented physical-security VLANs are substantially harder to reach. Patching above 1.19.5 (vendor advisory) removes the condition.

All severity signals point the same direction on paper: the vendor-supplied CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with high impact across both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H), yielding the maximum 10.0 score, and the arbitrary file write reportedly yields super-user permissions on the board (CWE-22 path traversal). However, the exploitation-probability signals do NOT corroborate this urgency: EPSS is only 0.48% (40th percentile), the CVE is NOT on the CISA KEV list, and no public exploit code was provided - so this is a high-CVSS issue without current evidence of real-world exploitation. A key conflict to verify: the vector asserts PR:N (unauthenticated) and AV:N, yet the described attack surface is a firmware 'Upgrade Feature,' which on most access-control/intercom appliances is an administrative function normally reachable only after authentication - verify with the vendor whether the upgrade endpoint is truly reachable pre-authentication, because that single fact determines whether this is remotely exploitable by anyone or only by an authenticated/privileged operator. No SSVC decision data was provided. Net: treat as a serious device-compromise bug to patch, but the absence of KEV/POC and low EPSS suggest it is not currently under mass exploitation.

An attacker reaches the firmware upgrade interface of a BLU-IC2 or BLU-IC4 intercom/access-control board and submits a malicious upgrade package containing a path-traversal file path, writing attacker-controlled content outside the intended directory. The arbitrary file write is then leveraged to overwrite a privileged file or script, resulting in super-user (root) control of the device. No public proof-of-concept was provided, and whether the upgrade endpoint is reachable without authentication should be confirmed with the vendor.