BLU-IC2/IC4 Firmware CVE-2025-12425

Exploitation requires the attacker to already have a local or low-privileged presence on a BLU-IC2 or BLU-IC4 device running firmware at or below 1.19.5 - consistent with the 'Local Privilege Escalation' description and CWE-269 - after which the privilege-management flaw grants full device control. The principal limiting factor is this prerequisite foothold: the device is specialized access-control/intercom hardware, not general-purpose, so the attacker must first reach the unit (physically or via network/service access). Note that the input CVSS vector's AV:N/PR:N claim would remove these limits entirely; that claim contradicts the description and should be confirmed with the vendor before relying on it.

Signals conflict sharply and must be reconciled before prioritizing. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with full VC/VI/VA and subsequent-system impact) yields a 10.0 'critical' score implying remote, unauthenticated, no-interaction compromise - yet the NVD description and CWE-269 (Improper Privilege Management) both characterize this as 'Local Privilege Escalation,' which normally implies a local vector and an existing low-privilege foothold. This is a material contradiction: a genuine local privilege-escalation flaw should not carry AV:N/PR:N. Verify the vector with the vendor (azure-access.com) - the 10.0 is likely an over-scoped rating. The EPSS score is low (0.22%, 11th percentile), there is no CISA KEV listing, and no public exploit is identified, all consistent with a low near-term exploitation likelihood. Net assessment: despite the headline 10.0, the realistic risk is moderate and contingent on an attacker first obtaining local/low-privilege access to the affected BLU-IC2/BLU-IC4 access-control hardware. Treat it as a priority only for operators of these specific devices, and patch past 1.19.5.

An attacker who has already obtained a low-privilege foothold on a BLU-IC2 or BLU-IC4 intercom/access-control device - via physical access to the unit, a compromised service account, or a prior network foothold - abuses the improper privilege management flaw (CWE-269) to elevate to full administrative/root control of the firmware. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed.