BLU-IC2/IC4 Firmware CVE-2025-12516

Requires network reachability to the HTTP service of a BLU-IC2 or BLU-IC4 device running firmware 1.19.5 or earlier; the CVSS vector's PR:N/UI:N indicates no authentication or user interaction is needed to reach the vulnerable error path. The trigger is a request that drives the server into an unhandled error state returning HTTP 5xx. Limiting factors: these are special-purpose access-control appliances that in well-segmented physical-security deployments are typically not exposed to the public internet, so exploitation usually presupposes attacker access to the management/LAN segment; the realistic impact also depends on what the error response actually discloses, which the description does not specify.

Signals conflict sharply and this must be flagged before any prioritization. The input CVSS 4.0 vector rates this 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N) with HIGH confidentiality, integrity AND availability on both the vulnerable and subsequent systems, implying full remote unauthenticated compromise. However, the description (CWE-394, 'Lack of Graceful Error Handling - HTTP 5xx Error') and the 'Information Disclosure' tag describe only an unhandled error condition that returns a 5xx response - a vulnerability class that typically yields minor information leakage or denial-of-service symptoms, NOT total system takeover. This is a material discrepancy: the scored impact is far more severe than the described defect, so the 10.0 should be treated as unverified until the vendor advisory is read. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of real-world exploitation. Combined with a niche access-control product footprint, realistic priority is LOWER than the raw 10.0 suggests - treat as 'high CVSS, impact unconfirmed, low observed exploitation' pending vendor confirmation of what the error handler actually exposes.

A remote, unauthenticated attacker sends a malformed or unexpected HTTP request to the web/management interface of a BLU-IC2 or BLU-IC4 door-access device running firmware 1.19.5 or earlier, triggering an ungracefully handled server error (HTTP 5xx). Depending on what the error path leaks, the response may disclose internal state, stack or configuration details useful for further attack. No public exploit code is known at time of analysis.