Azure Access BLU CVE-2025-12477

Affected devices are BLU-IC2 and BLU-IC4 running firmware version 1.19.5 or earlier; the fix presumably lies in a later firmware release (not specified in input). Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N), exploitation requires only network reachability to the device's server/web interface with no authentication, no user interaction, and no special attack requirements - so the primary limiting factor is network exposure of the device. In practice these are physical access-control intercom appliances typically deployed on internal or management networks, so exploitation is constrained to attackers who can route to the device; internet-exposed units would be directly reachable. As literally described, the triggered condition is disclosure of the server version; whether the unauthenticated path enables more (as CWE-306 implies) is not established by the Description.

The signals here are sharply contradictory and must be reconciled before prioritization. The vendor-supplied CVSS 4.0 vector scores 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with high impact to both the vulnerable and subsequent systems across confidentiality, integrity and availability), the CWE is CWE-306 (Missing Authentication for a Critical Function), and the tag set includes 'Authentication Bypass' - all of which describe a remote, unauthenticated, full-compromise flaw. Yet the human-readable Description reads only 'Server Version Disclosure,' which is a classic low-severity information-exposure issue (normally CWE-200, ~CVSS 5.3), not a total compromise. This is a direct, unresolved conflict: the title implies a minor information leak while the metadata implies critical missing authentication. EPSS is low at 0.35% (27th percentile), the CVE is NOT on CISA KEV, and no POC is referenced, so there is no public evidence of exploitation. Net assessment: if the CWE-306/CVSS 10.0 metadata is accurate, this is a genuine critical priority on exposed devices; if the Description is accurate, it is a modest information-disclosure issue over-scored by the metadata. Given the low EPSS, absence of KEV, no POC, and the niche deployment footprint of these access-control devices, this is unlikely to be mass-exploited in the near term, but the severity of the underlying flaw cannot be confirmed from the conflicting data and MUST be verified against the vendor advisory before final triage.

An attacker with network reachability to an exposed BLU-IC2 or BLU-IC4 device (firmware ≤1.19.5) sends an unauthenticated request to the device's server interface and receives server/version information back, per the Description. If the CWE-306 'Missing Authentication' metadata is accurate, the same unauthenticated access path could extend beyond version disclosure to unauthorized control of the intercom/access-control function. No public exploit code is referenced, so exploitation would currently require custom tooling.