BLU-IC2/IC4 Firmware CVE-2025-12553

Exploitation requires the attacker to occupy a man-in-the-middle / on-path position between the BLU-IC2 or BLU-IC4 device and the email (SMTP/TLS) server it is configured to use for notifications, AND requires the device to actually have email/SMTP functionality configured and enabled. Because the firmware (≤1.19.5) does not validate the mail server's TLS certificate, a forged certificate is accepted. LIMITING FACTORS: no exposure exists if email is not configured; exploitation is confined to email-channel confidentiality/integrity (intercepted messages, SMTP credentials, altered notifications) rather than direct device takeover; and the attacker must already control a network path to the mail server, so a purely remote off-path attacker cannot trigger it.

The CNA assigned CVSS 4.0 base score of 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with full vulnerable- AND subsequent-system impact VC/VI/VA:H + SC/SI/SA:H), but this rating is almost certainly inflated for a CWE-599 (Improper Certificate Validation) email flaw. Disabling email server certificate verification does not grant direct network-unauthenticated code execution; it enables a man-in-the-middle to intercept or tamper with the device's outbound email (SMTP/TLS) sessions. Realistic exploitation therefore requires the attacker to already hold a privileged on-path/MITM position between the BLU-IC device and its configured mail server, which should be AC:H, not AC:L, and the subsequent-system impact (SC/SI/SA:H) is unsupported by the description. Corroborating signals point to low real-world urgency: EPSS is 0.22% (12th percentile), the CVE is NOT in CISA KEV, and no public POC is referenced. CONFLICT TO NOTE: the near-maximum CVSS contradicts the low EPSS and absence of KEV/POC - treat this as a HIGH-severity-but-conditional MITM issue rather than a mass-exploitable remote takeover. Verify the true impact scope with the vendor advisory before prioritizing as a 10.0.

An attacker who can intercept traffic on the network path between a BLU-IC2/IC4 intercom and its configured email server (e.g., via ARP spoofing, rogue Wi-Fi, or a compromised upstream segment) presents a forged TLS certificate. Because the firmware (through 1.19.5) does not validate the email server's certificate, the device accepts the connection, letting the attacker read or alter email content and capture any SMTP credentials or notification data transmitted. No public exploit is identified at time of analysis; exploitation is hands-on and position-dependent rather than automated.