BLU-IC2/IC4 Firmware CVE-2025-12424

Exploitation requires local code-execution access to the device as a lower-privileged account in order to invoke the mis-privileged SUID-bit binary on BLU-IC2/BLU-IC4 firmware at or below version 1.19.5; the escalation is a post-access primitive, not a condition-free remote vector. Limiting factors: the attacker must first reach the device and run the binary (the SUID class contradicts the input vector's unauthenticated-network claim), only firmware ≤1.19.5 is affected, and the footprint is confined to these two specific intercom models. No special non-default feature toggle is named in the description - the vulnerable binary appears present in default firmware.

Signals conflict sharply and must be reconciled before prioritization. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with full VC/VI/VA and subsequent-system C/I/A High) yields a 10.0 that is inconsistent with the vulnerability class: a SUID-bit binary privilege escalation (CWE-269) is, by definition, a local primitive requiring an attacker to already execute code on the device as a lower-privileged user. AV:N and PR:N are therefore almost certainly incorrect for the root cause described - verify with the vendor advisory. The corroborating data points to genuinely lower real-world urgency: EPSS is 0.34% (26th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided sources, so this is 'no public exploit identified at time of analysis.' Net assessment: this is a high-impact-if-reached issue (local root on an access-control intercom is serious) but NOT a drive-by remote 10.0; realistic risk is that of a local/post-access privilege escalation on a niche appliance, not a wormable internet-facing flaw. Treat the vendor's 10.0 as metadata to be challenged, not a confirmed remote-unauth rating.

An attacker who has already obtained low-privileged code execution on a BLU-IC2 or BLU-IC4 intercom (e.g. via a web/service account, a chained remote bug, or physical/console access) invokes the vulnerable setuid binary to escalate to root and take full control of the device firmware (≤1.19.5). No public exploit code was identified in the provided sources, and realistic exploitation depends on first gaining a local foothold despite the input vector's AV:N claim.