BLU-IC2/IC4 Firmware CVE-2025-12479

Exploitation requires a user who is already authenticated to the BLU-IC2/BLU-IC4 web management interface (typically an administrator) to be tricked into loading attacker-controlled web content while that session is active; the systemic absence of anti-CSRF tokens then allows the forged request to be accepted as legitimate. Limiting factors: a valid concurrent authenticated session and victim interaction (visiting a malicious page) are effectively required, meaning the input vector's UI:N/PR:N claim likely overstates ease of exploitation. Affects all configurations of BLU-IC2 and BLU-IC4 firmware at or below version 1.19.5.

The input assigns a maximal CVSS 4.0 base score of 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with full High impact to both vulnerable and subsequent systems), yet this is in direct tension with the vulnerability class itself: CWE-352 (CSRF) inherently depends on a victim with an authenticated session being induced to issue forged requests, which normally implies some user interaction (UI) and reliance on an existing privileged session - so the UI:N / PR:N / scope-changing 10.0 rating is almost certainly inflated and should be verified with the vendor. Counterbalancing signals point to low real-world urgency: EPSS is only 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit code was identified, so this is a high-CVSS-but-low-current-threat issue rather than an active-exploitation priority. The affected products (Azure Access BLU-IC2 / BLU-IC4 firmware) are niche physical-access/intercom controllers with a limited deployment footprint, further reducing aggregate exposure. Net: credible and worth patching because a systemic absence of CSRF tokens on a door/access-control device is genuinely dangerous if an administrator is phished, but the 10.0 score overstates the practical risk relative to the EPSS/KEV/POC evidence.

An attacker crafts a malicious web page or email containing hidden requests to the BLU-IC2/IC4 web management interface and lures an authenticated administrator into opening it. Because the application lacks CSRF tokens throughout, the victim's browser silently submits attacker-chosen state-changing requests (e.g., creating accounts, altering access rules, or unlocking doors) using the admin's active session. No public exploit code is currently identified, so exploitation would require the attacker to build the forged requests from knowledge of the device's endpoints.