BLU-IC2/IC4 Firmware CVE-2025-12478

The affected BLU-IC2/BLU-IC4 firmware (through 1.19.5) ships with a non-compliant TLS configuration (CWE-326 inadequate encryption strength - e.g. weak ciphers or outdated protocol versions), so the condition is simply running the default/shipped firmware at or below 1.19.5; no special feature toggle is required. The key LIMITING factor is that exploitation of a transport-crypto weakness realistically requires the attacker to obtain a man-in-the-middle / on-path network position between the client and the device to intercept, downgrade, or manipulate the TLS session - it is not a point-and-click remote exploit against an exposed port despite the AV:N rating. Devices segmented on isolated access-control VLANs with no untrusted on-path presence are substantially less exposed.

Signals conflict sharply and should temper the headline score. The vendor-supplied CVSS 4.0 vector rates this 10.0 Critical with full confidentiality, integrity, AND availability impact on both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H), implying complete remote compromise. That is difficult to reconcile with the actual weakness class, CWE-326 (Inadequate Encryption Strength) described only as a 'Non-Compliant TLS Configuration' - a weak-crypto/transport issue that typically enables interception or manipulation of traffic by a man-in-the-middle, not direct arbitrary code execution or system takeover. The scope-change/availability metrics appear inflated for a TLS hardening defect and should be verified against the vendor advisory. Corroborating exploitation signals are low: EPSS is 0.24% (14th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data. Net assessment: despite the 10.0 label, real-world risk is more consistent with a Medium/High transport-security exposure requiring a privileged network position, not a wormable unauthenticated RCE. Treat it as a meaningful hardening priority for exposed BLU-IC2/IC4 deployments, but the Critical rating likely overstates exploitability - confirm concrete impact with the Azure Access advisory before emergency prioritization.

An attacker positioned on the network path between a client and a BLU-IC2 or BLU-IC4 door-station (through firmware 1.19.5) exploits the weak/non-compliant TLS configuration to intercept or downgrade the encrypted channel, decrypting or tampering with access-control traffic such as credentials, door-release commands, or intercom data. No public exploit code was identified at time of analysis, and the attack depends on achieving a man-in-the-middle position rather than directly reaching the device over the open internet.