BLU-IC Firmware CVE-2025-12517

The attacker must be authenticated to the BLU-IC2/BLU-IC4 firmware interface (PR:L) and must actively navigate to/view the firmware Credits page (UI:P), which only displays - it does not allow modification. The defect is that this page reports third-party component versions that do not match those actually running in firmware versions up to and including 1.19.5. Limiting factors are substantial: valid credentials are required, exploitation is passive and interaction-dependent, additional attack requirements apply (AT:P), and complexity is High (AC:H); there is no path from this flaw to code execution or data modification, so its practical effect is limited to inaccurate version/component reporting that can mislead patch-state and vulnerability assessments.

This is a low-priority issue, consistent across every available signal. The vendor-supplied CVSS 4.0 base score is only 2.1 (Low), driven by a difficult-to-exploit, authenticated, user-interaction-dependent vector (AV:N/AC:H/AT:P/PR:L/UI:P) with uniformly Low technical impact (VC:L/VI:L/VA:L). CWE-448 (Obsolete Feature in UI) and the 'Information Disclosure' tag align with the description: the firmware 'Credits' page lists third-party component versions that do not match the versions actually running. This is an accuracy/information-quality defect, not a memory-corruption or access-control break. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The impact metrics (VI:L/VA:L) in the vendor vector are arguably generous for what is fundamentally a display-accuracy bug - integrity and availability impact are questionable since the flaw does not let an attacker modify system state; this is the main point of conflict between the vendor scoring and the described behavior. Net assessment: genuine low real-world risk, not a high-CVSS-but-hidden-danger case - if anything it is a low-CVSS-and-low-real-risk case whose primary security relevance is that it can mislead defenders about which component versions (and thus which known CVEs) are present on the device.

An authenticated operator or attacker with device access views the firmware Credits/About page to inventory third-party components, but the listed versions are stale or incorrect, masking that vulnerable component versions are actually in use. No public exploit code exists; the realistic 'exploitation' is passive - relying on inaccurate version reporting to evade patch/vulnerability tracking rather than directly compromising the device.