Azure Access
Monthly
/etc/timezone can be Arbitrarily Written.19.5; BLU-IC4: through 1.19.5. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
/etc/avahi/services/z9.service can be Arbitrarily Written.19.5; BLU-IC4: through 1.19.5. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
Denial of Service Due to SlowLoris.19.5; BLU-IC4: through 1.19.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Web UI Malfunction when setting unexpected locale via API.19.5; BLU-IC4: through 1.19.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000).19.5; BLU-IC4: through 1.19.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Azure Access OS firmware through 1.19.5 on BLU-IC2 and BLU-IC4 physical access controllers contains unspecified vulnerable components that expose the devices to a maximum-severity network attack. The supplied CVSS 4.0 vector (10.0) describes a remote, unauthenticated, low-complexity compromise with high confidentiality, integrity, and availability impact on both the vulnerable device and subsequent systems, although the exact vulnerable feature and prerequisites are not disclosed and these controllers are typically confined to internal building-management networks. No public exploit was identified at time of analysis and EPSS is 0.37% (29th percentile), so near-term exploitation likelihood is assessed as low despite the critical score.
Persistent denial of service affects Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5: a malicious or malformed installed app cannot be uninstalled, leaving the device unavailable. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) indicates network-reachable, authenticated low-privilege exploitation, while the vendor's CVSS 4.0 vector claims PR:N and broader impact; authentication requirements for the app-installation function should be confirmed against the vendor advisory. No public exploit was identified at time of analysis, KEV status is not indicated, and EPSS is 0.22% (11th percentile), suggesting low observed exploitation likelihood.
Information disclosure through an enabled serial console on BLU-IC2 and BLU-IC4 devices (firmware through 1.19.5) lets someone with physical access to the device's serial interface observe diagnostic and boot-level output that can reveal further weaknesses and ease follow-on research or attack development. The vendor's own CVSS 4.0 vector scores this 5.2 with AV:L/AC:H/PR:N/UI:P, meaning unauthenticated but local (physically adjacent) access, high attack complexity, and only low confidentiality/integrity/availability impact to the device itself; our independent assessment corroborates this as a genuinely low-priority issue (CVSS 3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). There is no KEV listing and no public exploit code identified at time of analysis, and EPSS is only 0.11% (1st percentile), so remote or scaled exploitation is not a realistic concern - the real risk is an attacker who already has hands on the hardware.
Denial-of-service conditions in Azure Access Technology BLU-IC2 and BLU-IC4 firmware through 1.19.5 allow remote attackers to exhaust device resources by sending sustained request floods, potentially making physical access-control and intercom services unavailable. NVD's CVSS 4.0 vector scores this 10.0 with high confidentiality, integrity, and availability impact, but the independent assessment finds only availability impact (CVSS 3.1 7.5), so confidentiality and integrity effects should be treated as unconfirmed. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.37% (29th percentile).
/etc/timezone can be Arbitrarily Written.19.5; BLU-IC4: through 1.19.5. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
/etc/avahi/services/z9.service can be Arbitrarily Written.19.5; BLU-IC4: through 1.19.5. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
Denial of Service Due to SlowLoris.19.5; BLU-IC4: through 1.19.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Web UI Malfunction when setting unexpected locale via API.19.5; BLU-IC4: through 1.19.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000).19.5; BLU-IC4: through 1.19.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Azure Access OS firmware through 1.19.5 on BLU-IC2 and BLU-IC4 physical access controllers contains unspecified vulnerable components that expose the devices to a maximum-severity network attack. The supplied CVSS 4.0 vector (10.0) describes a remote, unauthenticated, low-complexity compromise with high confidentiality, integrity, and availability impact on both the vulnerable device and subsequent systems, although the exact vulnerable feature and prerequisites are not disclosed and these controllers are typically confined to internal building-management networks. No public exploit was identified at time of analysis and EPSS is 0.37% (29th percentile), so near-term exploitation likelihood is assessed as low despite the critical score.
Persistent denial of service affects Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5: a malicious or malformed installed app cannot be uninstalled, leaving the device unavailable. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) indicates network-reachable, authenticated low-privilege exploitation, while the vendor's CVSS 4.0 vector claims PR:N and broader impact; authentication requirements for the app-installation function should be confirmed against the vendor advisory. No public exploit was identified at time of analysis, KEV status is not indicated, and EPSS is 0.22% (11th percentile), suggesting low observed exploitation likelihood.
Information disclosure through an enabled serial console on BLU-IC2 and BLU-IC4 devices (firmware through 1.19.5) lets someone with physical access to the device's serial interface observe diagnostic and boot-level output that can reveal further weaknesses and ease follow-on research or attack development. The vendor's own CVSS 4.0 vector scores this 5.2 with AV:L/AC:H/PR:N/UI:P, meaning unauthenticated but local (physically adjacent) access, high attack complexity, and only low confidentiality/integrity/availability impact to the device itself; our independent assessment corroborates this as a genuinely low-priority issue (CVSS 3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). There is no KEV listing and no public exploit code identified at time of analysis, and EPSS is only 0.11% (1st percentile), so remote or scaled exploitation is not a realistic concern - the real risk is an attacker who already has hands on the hardware.
Denial-of-service conditions in Azure Access Technology BLU-IC2 and BLU-IC4 firmware through 1.19.5 allow remote attackers to exhaust device resources by sending sustained request floods, potentially making physical access-control and intercom services unavailable. NVD's CVSS 4.0 vector scores this 10.0 with high confidentiality, integrity, and availability impact, but the independent assessment finds only availability impact (CVSS 3.1 7.5), so confidentiality and integrity effects should be treated as unconfirmed. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.37% (29th percentile).