BLU-IC2 CVE-2025-12423

Exploitation requires network reachability to the BLU-IC2/BLU-IC4 reader's protocol/communication interface; per the CVSS vector it is unauthenticated (PR:N), requires no user interaction (UI:N), and is low-complexity (AC:L/AT:N), so any attacker who can send traffic to the device's exposed protocol port can trigger it. The specific protocol and whether it is enabled by default are not identified in the available data ('protocol manipulation' only), which should be clarified with the vendor. The primary limiting factor is network exposure: these are physical access-control appliances typically deployed on segmented/internal or management networks, so impact is confined to actors who can reach the device; impact is limited to loss of availability (device crash/hang), not data compromise.

Signals conflict sharply and the headline CVSS 4.0 base score of 10.0 (AV:N/AC:L/PR:N/UI:N with VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H) is not supported by the description or the assigned weakness. The description states only that 'protocol manipulation might lead to denial of service,' and CWE-248 (uncaught exception) is an availability-only failure mode; a true DoS should score VC:N/VI:N/VA:H, not full confidentiality and integrity impact - the 10.0 appears inflated/mis-scored and should be verified with the vendor. On real-world exploitation signals the picture is low-to-moderate: EPSS is 0.34% (25th percentile), there is no CISA KEV listing, and no public exploit code is referenced, so there is no evidence of active or imminent widespread exploitation. The network-reachable, unauthenticated, low-complexity nature (PR:N/AC:L/AT:N) does make the DoS trivially triggerable where the device's protocol interface is exposed, so it is a genuine availability concern for anyone running BLU-IC2/BLU-IC4 access-control readers - but it is a 'high-CVSS, lower-real-risk' case rather than a top-priority RCE. Note also the word 'might' in the description signals vendor uncertainty about impact. Bottom line: treat as a credible unauthenticated DoS to patch on a normal cycle, not an emergency, and reconcile the overstated CVSS before using the 10.0 for prioritization.

An attacker with network reachability to an exposed BLU-IC2/BLU-IC4 access-control reader sends malformed or manipulated protocol traffic to the device's network interface, triggering an uncaught exception (CWE-248) that crashes or hangs the firmware. This renders the door/biometric reader unavailable until it is restarted, potentially disrupting physical access control. No public proof-of-concept or exploit code is referenced in the available data.