BLU-IC2/IC4 Firmware CVE-2025-12515

Requires network access to the web/management service of a BLU-IC2 or BLU-IC4 access controller running firmware up to and including 1.19.5; per the provided CVSS vector (PR:N/UI:N) no authentication or user interaction is indicated. Limiting factors: these are specialized physical-access-control appliances typically deployed on internal or restricted facility networks rather than exposed to the public internet, which materially narrows the realistic attack surface; the exact triggering request, the specific endpoints affected, and whether impact is genuine data disclosure versus mere service errors are not specified in the available data and should be confirmed against the Azure Access advisory.

The input assigns CVSS 4.0 10.0 (Critical) with all vulnerable-system and subsequent-system impacts rated High (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) under a fully remote, unauthenticated, low-complexity vector (AV:N/AC:L/AT:N/PR:N/UI:N). This score sharply conflicts with the actual description and CWE: the description reads 'Systemic Internal Server Errors - HTTP 500 Response' and the weakness is CWE-394 (Unexpected Status Code or Return Value), which typically describes error-handling/information-exposure behavior rather than full confidentiality, integrity AND availability compromise of both the device and downstream systems. A 10.0 with maximal subsequent-system impact is not substantiated by the sparse description - treat the severity as likely inflated and verify with the vendor advisory. There is no EPSS score, no CISA KEV listing, and no POC in the provided data, so there is no evidence of real-world or probable exploitation; the KEV/EPSS/POC signals are all absent rather than conflicting. Net: despite the nominal 10.0, the supporting data points to a lower-impact error-handling/information-disclosure issue in a niche physical-access-control appliance, so this is more plausibly a moderate-priority patch item than an emergency, pending independent confirmation of actual impact from Azure Access.

An attacker with network reachability to a BLU-IC2 or BLU-IC4 controller's web interface sends crafted or malformed requests that the firmware (through 1.19.5) fails to handle, producing systemic HTTP 500 responses whose error output may disclose internal state or disrupt the service. No public exploit code is identified at time of analysis, and the attack appears to require only network access per the provided vector (AV:N/AC:L/PR:N/UI:N).