BLU-IC2/IC4 Firmware CVE-2025-12552

Exploitation requires network access to the device's authentication/login interface and depends on the firmware (BLU-IC2 and BLU-IC4 through 1.19.5) accepting weak passwords and lacking sufficient brute-force protection (CWE-521) - the weakness only yields access when a reachable account has a guessable password. Limiting factors: the device must be network-exposed (these access-control/intercom units are often on segmented or internal networks, which sharply reduces real-world reachability), success still hinges on an administrator having chosen a weak credential, and the per-success impact is Low (VC:L/VI:L/VA:L) rather than full takeover. There is no CISA KEV listing and no public exploit identified at time of analysis.

This is a genuine but moderate-priority issue, not an urgent one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated weakness, and CWE-521 (Weak Password Requirements) combined with the 'Brute Force' tag indicates the device permits weak passwords that can be guessed remotely. However, the base score of 6.9 reflects only Low confidentiality/integrity/availability impact (VC:L/VI:L/VA:L), meaning a single successful guess yields limited direct impact rather than full compromise. Exploitation signals are weak: EPSS is 0.34% (26th percentile), there is no CISA KEV listing, and no public exploit was identified - so this is a latent configuration/design weakness rather than something under active mass exploitation. One conflict to verify: PR:N is scored as unauthenticated, yet the vulnerability class (insufficient password policy enabling brute force) only matters when accounts and a login interface exist, so real impact depends on an operator having set a weak password and on the device's authentication endpoint being network-exposed. Overall: patch/mitigate on a normal cadence and prioritize if these intercoms are internet-facing, but this does not carry the emergency weight of a remote code execution flaw.

An attacker with network reachability to a BLU-IC2 or BLU-IC4 device's login interface runs an automated brute-force or credential-guessing attack, succeeding because the firmware (through 1.19.5) does not enforce strong password requirements or adequate lockout. No public exploit code is required - standard password-spraying tooling suffices - and the low attack complexity (AC:L) means no special timing or conditions are needed once the interface is reachable.