Blu Ic4 Firmware
Monthly
/etc/timezone can be Arbitrarily Written.19.5; BLU-IC4: through 1.19.5. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
/etc/avahi/services/z9.service can be Arbitrarily Written.19.5; BLU-IC4: through 1.19.5. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
Denial of Service Due to SlowLoris.19.5; BLU-IC4: through 1.19.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Web UI Malfunction when setting unexpected locale via API.19.5; BLU-IC4: through 1.19.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000).19.5; BLU-IC4: through 1.19.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The web management interface on Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5 omits standard HTTP security response headers (Content-Security-Policy, X-Frame-Options, HSTS, and similar), leaving operator browsers without browser-enforced protections against clickjacking and transport downgrade. Per the CVSS 4.0 vector the endpoint is reachable without credentials (PR:N), but the independent assessment re-scores this as CVSS:3.1 AV:N/AC:L/PR:N/UI:R/C:L/I:L/A:N because meaningful abuse requires a second condition: a logged-in operator lured to an attacker-controlled frame, or an attacker already positioned to intercept traffic. Impact is Low across confidentiality, integrity, and availability, EPSS is 0.37% (29th percentile), the issue is not in CISA KEV, and no public exploit code was identified at time of analysis. Real-world exposure is further bounded because these access-control appliances are normally deployed on internal building networks rather than the public internet.
Email notification functionality in BLU-IC2 and BLU-IC4 firmware through version 1.19.5 fails to validate the TLS certificate of the configured SMTP server, so an on-path attacker presenting a forged certificate is silently accepted. Affected devices must have email/SMTP configured and enabled to be exposed; the impact is confined to the email channel - intercepted notifications, captured SMTP credentials, and tampered message content - rather than direct device compromise. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS is low at 0.22% (12th percentile); the CVE's 10.0 CVSS 4.0 score should be treated skeptically given the authenticated-path and configuration preconditions assessed by this analysis.
Azure Access BLU-IC2 and BLU-IC4 access-control/intercom units running firmware through version 1.19.5 do not enforce an adequate password policy, letting remote attackers reach the login interface and repeatedly guess credentials because weak passwords are accepted and brute-force protections are insufficient. Successful guessing yields only low-impact access (confidentiality, integrity and availability all rated Low) rather than full device takeover, and reachability is further limited because these units typically sit on segmented or internal networks. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.34% (26th percentile), so this is a genuine but moderate-priority hardening issue rather than an urgent one.
Misleading component-version reporting in Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5 causes the Credits page to display third-party component versions that do not match the software actually running, which can cause administrators to misjudge patch state. Exploitation requires authenticated access to the firmware interface and a user viewing the Credits page; it is low severity (CVSS 2.1), no public exploit was identified at time of analysis, and CISA KEV does not list it.
Unhandled error conditions in the HTTP service of BLU-IC2 and BLU-IC4 access-control appliances running firmware 1.19.5 or earlier cause the devices to return HTTP 5xx responses that can leak implementation details, an information-disclosure weakness classified as CWE-394 (Unexpected Status Code or Return Value). The authoritative assessment scores this CVSS 3.1 as AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - unauthenticated network reachability, no user interaction, low confidentiality impact only - while the published CVSS 4.0 score of 10.0 asserts high confidentiality, integrity and availability impact across scope; that discrepancy is material and must be resolved before prioritization. No public exploit code and no CISA KEV entry were identified at time of analysis, though the appliances are typically segmented on physical-security networks rather than internet-exposed.
Systemic HTTP 500 error responses in Azure Access BLU-IC2 and BLU-IC4 access controller firmware through version 1.19.5 can be induced by remote, unauthenticated requests, resulting in limited information exposure and partial availability impact as assessed under CVSS 3.1 (C:L/I:N/A:L). The condition stems from improper handling of unexpected status codes or return values (CWE-394) and affects specialized physical access control appliances. No public exploit code or CISA KEV entry was identified at time of analysis, and practical risk is narrowed by the devices' typical deployment on internal or restricted facility networks rather than the public internet.
Cross-site request forgery in Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5 allows remote attackers to induce an authenticated administrator to submit forged state-changing requests to the web management interface because anti-CSRF tokens are not implemented. Exploitation requires a concurrent privileged session and victim interaction, so the supplied CVSS 4.0 score of 10.0 is likely inflated; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. No public exploit was identified at time of analysis, and EPSS is 0.17% (percentile 6%).
BLU-IC2 and BLU-IC4 firmware through version 1.19.5 ships with a non-compliant TLS configuration (CWE-326, inadequate encryption strength), meaning transport sessions can be protected by deprecated protocol versions, weak cipher suites, or insufficient key lengths. An attacker who can obtain a man-in-the-middle position on the network path between a client and the device could intercept, downgrade, or manipulate those sessions to disclose or alter data in transit. The vendor assigns a maximum 10.0 CVSS 4.0 score, but exploitation realistically depends on an on-path presence rather than direct remote access to an exposed service, integrity impact is limited, and no public exploit has been identified at time of analysis; EPSS is 0.24% (14th percentile).
Unauthenticated remote attackers can retrieve server version information from Azure Access BLU-IC2 and BLU-IC4 physical access-control intercom appliances running firmware 1.19.5 or earlier, exposing fingerprinting data that aids follow-on targeting. The CWE-306 classification (Missing Authentication for Critical Function) hints that the underlying weakness may be a missing authentication check rather than a purely cosmetic banner leak, but the description as written establishes only version disclosure, and our assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - confidentiality-only, no integrity or availability impact. EPSS is 0.35% (27th percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis; the practical risk is gated almost entirely by whether these appliances are reachable from untrusted networks.
Unauthenticated remote access to a critical function in Azure Access BLU-IC2/IC4 firmware through 1.19.5 lets a network attacker reach privileged functionality without credentials, with high impact to confidentiality, integrity, and availability on the device and on subsequent systems. The CVSS 4.0 base score is 10.0, matching the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), so practical risk is driven mainly by whether the management/network interface is reachable; EPSS is low at 0.34% (26th percentile) and no public exploit identified at time of analysis.
Privilege escalation in Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5 lets an attacker with an existing low-privileged foothold gain full device control via an improper privilege-management flaw (CWE-269). The independent assessment scores this CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, requiring local access or low privileges, while the input CVSS 4.0 AV:N/PR:N/10.0 claim conflicts with the 'Local Privilege Escalation' description and should be confirmed with the vendor; EPSS is 0.22% (11th percentile) and no public exploit is identified at time of analysis.
Local privilege escalation in Azure Access BLU-IC2 and BLU-IC4 intercom firmware through 1.19.5 allows a lower-privileged local user to abuse a misconfigured SUID-bit binary and obtain elevated privileges. The authoritative assessment rates this as local, low-complexity, low-privilege exploitation (CVSS 3.1 AV:L/PR:L), which conflicts with the supplied CVSS 4.0 network/no-auth vector and should take precedence for prioritization. EPSS is 0.34% (26th percentile), and no CISA KEV entry or public exploit code is identified in the provided data.
Denial of service in Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5 allows unauthenticated network attackers who can reach the device's protocol/communication interface to crash or hang the appliance via crafted protocol manipulation. The authoritative assessment limits impact to availability loss (C:N/I:N/A:H) and does not support the headline CVSS 4.0 score of 10.0, which claims high confidentiality, integrity, and subsequent-system impact. No public exploit or CISA KEV confirmation was identified at time of analysis, and EPSS is low at 0.34% (25th percentile).
Arbitrary file write via path traversal in the firmware upgrade feature of Azure Access BLU-IC2 and BLU-IC4 boards (firmware through 1.19.5) allows unauthenticated, network-accessible attackers to write files to arbitrary locations, potentially gaining super-user permissions on the device. The vendor CVSS 4.0 vector rates this 10.0 with high impact to both the vulnerable system and subsequent systems, though the independent assessment notes that upgrade interfaces are often administrative and may in practice require authentication or management-network access. No public exploit identified at time of analysis; EPSS is low at 0.48% (40th percentile).
Error output produced by the web management interface of BLU-IC2 and BLU-IC4 access-control appliances (firmware through 1.19.5) is wrapped into HTTP response headers, disclosing sensitive diagnostic detail to any remote client able to induce a failure condition. The CVSS 4.0 base score is 6.9, but our assessment bounds real impact to low-confidentiality information disclosure - no code execution, data modification, or denial of service - on appliances that are normally deployed on internal or segmented networks. No public exploit code or active exploitation has been identified at time of analysis (EPSS 0.25%, 15th percentile).
Weak password policy in Azure Access BLU-IC2 and BLU-IC4 intercom access controller firmware through version 1.19.5 can make management credentials guessable, allowing brute-force or credential-guessing attacks that, if successful, could expose sensitive information and enable high-impact configuration changes. The supplied CVSS 4.0 score is 10.0, but the independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H because exploitation depends on a weak credential actually being present and the authentication interface being reachable. No public exploit identified at time of analysis, and EPSS is low at 0.34% (26th percentile).
Email/SMTP password disclosure in Azure Access BLU-IC2 and BLU-IC4 intercom firmware through 1.19.5 allows unauthenticated remote attackers with network reachability to retrieve stored email account credentials, but only on units where an email/SMTP account is configured. No public exploit code was identified at time of analysis, and EPSS is low at 0.32% (23rd percentile). The reported CVSS 4.0 score of 10.0 conflicts with the assessed CVSS 3.1 confidentiality-only impact (C:H/I:N/A:N) and with the practical prerequisites of network exposure and a configured email account.
BLU-IC2 and BLU-IC4 access-control/intercom units running firmware 1.19.5 or earlier ship with a factory default password and never force the operator to replace it during initial provisioning, so anyone who can reach the management interface with the publicly known default credentials gains full administrative control of the device. The flaw is unauthenticated from the attacker's perspective (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C with high confidentiality, integrity and availability impact to both the device and connected systems) and carries a CVSS 4.0 base score of 10.0. Exploitation is not confirmed in the wild (not in CISA KEV) and no public exploit code has been identified at time of analysis, while EPSS sits at 0.34% (26th percentile) - real-world risk is driven almost entirely by whether the management interface of these specialized building-network devices is reachable from untrusted networks.
Improper input validation in the web management interface of Azure Access BLU-IC2 and BLU-IC4 access-control/intercom appliances running firmware 1.19.5 and earlier lets unauthenticated remote attackers submit crafted input that yields limited confidentiality, integrity, and availability impact (CVSS 4.0 base 6.9; vendor-tagged as an information disclosure issue). Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) no credentials or user interaction are required, so exposure is governed almost entirely by whether the device's web UI is reachable - these appliances normally sit on internal or management networks rather than the public internet. Risk is moderate and low-urgency: EPSS is 0.19% (9th percentile) and no public exploit code or CISA KEV entry was identified at time of analysis.
BLU-IC2 and BLU-IC4 firmware through 1.19.5 fail to terminate authenticated sessions on logout, letting an attacker who obtains or reuses an un-terminated session token retain management-interface access; despite the 6.9 CVSS 4.0 score, this is a moderate, low-priority issue. Exploitation requires a pre-existing authenticated session-typically on a shared or unattended terminal or via a stolen token-so the vendor's CVSS 4.0 PR:N rating overstates reachability; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS is 0.20% (10th percentile) and no public exploit was identified at time of analysis.
Unauthenticated remote command execution affects Azure Access BLU-IC2 and BLU-IC4 firmware through version 1.19.5, where attacker-supplied input that manipulates the device's mail configuration file is later processed in a way that executes injected OS commands. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H and SC/SI/SA:H) yields a maximum 10.0 base score and matches our independent CVSS 3.1 assessment of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, meaning no credentials and no user interaction are needed - the realistic barrier is network reachability of the appliance's management/mail-configuration interface. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.54% (44th percentile), so exposure is dominated by whether these devices are internet-facing rather than by observed exploitation.
The BLU-IC2 and BLU-IC4 firmware through 1.19.5 ship the outdated BusyBox 1.31.1 userland, exposing an aggregated set of known BusyBox weaknesses tracked as CVE-2025-12221. Exploitation requires a low-privilege authenticated attacker, a non-default attack prerequisite, and passive user interaction, with low confidentiality, integrity, and availability impact. No public exploit code or CISA KEV active exploitation is identified, and EPSS is 0.17% (5th percentile), making this a low-priority issue across nearly all signals.
Network-reachable BLU-IC2 and BLU-IC4 devices running firmware through 1.19.5 embed BusyBox 1.31.1 and are exposed to multiple known BusyBox weaknesses that can compromise confidentiality, integrity, and availability. The vendor's CVSS 4.0 score is 10.0, but our assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N with high C/I/A impact because exploitation depends on reaching a specific network-facing BusyBox service or applet whose identity is not confirmed. EPSS is 0.37% (29th percentile) and no public exploit identified at time of analysis.
Azure Access OS firmware through 1.19.5 on BLU-IC2 and BLU-IC4 physical access controllers contains unspecified vulnerable components that expose the devices to a maximum-severity network attack. The supplied CVSS 4.0 vector (10.0) describes a remote, unauthenticated, low-complexity compromise with high confidentiality, integrity, and availability impact on both the vulnerable device and subsequent systems, although the exact vulnerable feature and prerequisites are not disclosed and these controllers are typically confined to internal building-management networks. No public exploit was identified at time of analysis and EPSS is 0.37% (29th percentile), so near-term exploitation likelihood is assessed as low despite the critical score.
BLU-IC2 and BLU-IC4 access-control appliances running firmware 1.19.5 or earlier ship with factory-default credentials that, when left unchanged, let any remote attacker who can reach the device log in with publicly guessable values and take full administrative control (CWE-1392). Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), no account or user interaction is required and the scope change means compromised appliances can be leveraged against downstream systems they gate - meaningful for devices of this class that are frequently internet-facing or on lightly segmented networks. The risk signals conflict sharply: a maximum-severity CVSS 4.0 base score of 10.0 and full C/I/A loss sit against a low EPSS of 0.30% (21st percentile) and no CISA KEV entry or public exploit code identified at time of analysis, so the practical risk is dominated entirely by whether an operator has actually rotated the defaults. The primary limiting factor is remediation state, not attacker capability: environments that have already changed default credentials are not exploitable via this vector.
BLU-IC2 and BLU-IC4 building-access appliance firmware (through 1.19.5) ships with the SNMP community string left at the factory default 'public', letting remote attackers who can reach UDP/161 query the device for information. No public exploit code has been identified at time of analysis, and EPSS is low at 0.30% (21st percentile). This is a genuine but modest-severity exposure, not a top-tier emergency: impact is bounded to what read-only SNMP data the 'public' community exposes, and exploitation is defeated entirely if administrators have changed the community string, disabled SNMP, or firewalled the service.
Persistent denial of service affects Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5: a malicious or malformed installed app cannot be uninstalled, leaving the device unavailable. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) indicates network-reachable, authenticated low-privilege exploitation, while the vendor's CVSS 4.0 vector claims PR:N and broader impact; authentication requirements for the app-installation function should be confirmed against the vendor advisory. No public exploit was identified at time of analysis, KEV status is not indicated, and EPSS is 0.22% (11th percentile), suggesting low observed exploitation likelihood.
BLU-IC2 and BLU-IC4 firmware through 1.19.5 contain undocumented administrative accounts that allow network-reachable attackers to obtain administrative control without legitimate authentication, as reflected by the PR:N vector. Successful exploitation can fully compromise the confidentiality, integrity, and availability of the terminal and, because the assessed scope is changed, may affect connected systems. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.34% (26th percentile), but the potential impact remains severe.
Information disclosure through an enabled serial console on BLU-IC2 and BLU-IC4 devices (firmware through 1.19.5) lets someone with physical access to the device's serial interface observe diagnostic and boot-level output that can reveal further weaknesses and ease follow-on research or attack development. The vendor's own CVSS 4.0 vector scores this 5.2 with AV:L/AC:H/PR:N/UI:P, meaning unauthenticated but local (physically adjacent) access, high attack complexity, and only low confidentiality/integrity/availability impact to the device itself; our independent assessment corroborates this as a genuinely low-priority issue (CVSS 3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). There is no KEV listing and no public exploit code identified at time of analysis, and EPSS is only 0.11% (1st percentile), so remote or scaled exploitation is not a realistic concern - the real risk is an attacker who already has hands on the hardware.
Outdated third-party UI dependencies in BLU-IC2 and BLU-IC4 firmware through 1.19.5 can expose the management web interface to remote, unauthenticated exploitation, primarily risking information disclosure with lower integrity and availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.41% (34th percentile). Real-world exposure is limited by reachability of the device UI, since these access-control appliances are often segmented onto internal or restricted networks.
Session cookies issued by the BLU-IC2 and BLU-IC4 device web interfaces (firmware through 1.19.5) are set without the Secure and HttpOnly attributes, so any party able to run JavaScript inside the device's web context or to intercept cleartext HTTP traffic can read those cookies and replay them to hijack an authenticated administrative session. Exploitation is not standalone: it requires a pre-existing script-injection (XSS) foothold or a network man-in-the-middle position, plus a live authenticated session cookie and reachability to the web UI, so despite the raw CVSS 4.0 score of 5.3 the practical risk is low-to-moderate. No public exploit code was identified at time of analysis, the issue is not KEV-listed, and EPSS is only 0.21% (10th percentile).
Stored cross-site scripting in BLU-IC2 and BLU-IC4 firmware through 1.19.5 allows an attacker who can introduce an unsanitized application manifest to execute script in a victim's browser session when the stored content is rendered. The vendor CVSS 4.0 score is 10.0, but the independent assessment is CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating some management access plus user interaction are required; EPSS is low at 0.19% (9th percentile), and no public exploit was identified at time of analysis.
BLU-IC2 and BLU-IC4 firmware through 1.19.5 can return API responses with a text/html Content-Type instead of application/json, allowing HTML/JavaScript injection into the reply and script execution in a victim's browser session when the crafted response is loaded. The issue is network-reachable and unauthenticated from the request perspective but requires victim interaction (UI:R); it is not direct firmware code execution. No public exploit code or active exploitation has been identified (EPSS 0.26%, 16th percentile), and the independent assessment rates impact as limited confidentiality/integrity with no availability effect.
Denial-of-service conditions in Azure Access Technology BLU-IC2 and BLU-IC4 firmware through 1.19.5 allow remote attackers to exhaust device resources by sending sustained request floods, potentially making physical access-control and intercom services unavailable. NVD's CVSS 4.0 vector scores this 10.0 with high confidentiality, integrity, and availability impact, but the independent assessment finds only availability impact (CVSS 3.1 7.5), so confidentiality and integrity effects should be treated as unconfirmed. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.37% (29th percentile).
/etc/timezone can be Arbitrarily Written.19.5; BLU-IC4: through 1.19.5. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
/etc/avahi/services/z9.service can be Arbitrarily Written.19.5; BLU-IC4: through 1.19.5. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
Denial of Service Due to SlowLoris.19.5; BLU-IC4: through 1.19.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Web UI Malfunction when setting unexpected locale via API.19.5; BLU-IC4: through 1.19.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000).19.5; BLU-IC4: through 1.19.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The web management interface on Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5 omits standard HTTP security response headers (Content-Security-Policy, X-Frame-Options, HSTS, and similar), leaving operator browsers without browser-enforced protections against clickjacking and transport downgrade. Per the CVSS 4.0 vector the endpoint is reachable without credentials (PR:N), but the independent assessment re-scores this as CVSS:3.1 AV:N/AC:L/PR:N/UI:R/C:L/I:L/A:N because meaningful abuse requires a second condition: a logged-in operator lured to an attacker-controlled frame, or an attacker already positioned to intercept traffic. Impact is Low across confidentiality, integrity, and availability, EPSS is 0.37% (29th percentile), the issue is not in CISA KEV, and no public exploit code was identified at time of analysis. Real-world exposure is further bounded because these access-control appliances are normally deployed on internal building networks rather than the public internet.
Email notification functionality in BLU-IC2 and BLU-IC4 firmware through version 1.19.5 fails to validate the TLS certificate of the configured SMTP server, so an on-path attacker presenting a forged certificate is silently accepted. Affected devices must have email/SMTP configured and enabled to be exposed; the impact is confined to the email channel - intercepted notifications, captured SMTP credentials, and tampered message content - rather than direct device compromise. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS is low at 0.22% (12th percentile); the CVE's 10.0 CVSS 4.0 score should be treated skeptically given the authenticated-path and configuration preconditions assessed by this analysis.
Azure Access BLU-IC2 and BLU-IC4 access-control/intercom units running firmware through version 1.19.5 do not enforce an adequate password policy, letting remote attackers reach the login interface and repeatedly guess credentials because weak passwords are accepted and brute-force protections are insufficient. Successful guessing yields only low-impact access (confidentiality, integrity and availability all rated Low) rather than full device takeover, and reachability is further limited because these units typically sit on segmented or internal networks. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.34% (26th percentile), so this is a genuine but moderate-priority hardening issue rather than an urgent one.
Misleading component-version reporting in Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5 causes the Credits page to display third-party component versions that do not match the software actually running, which can cause administrators to misjudge patch state. Exploitation requires authenticated access to the firmware interface and a user viewing the Credits page; it is low severity (CVSS 2.1), no public exploit was identified at time of analysis, and CISA KEV does not list it.
Unhandled error conditions in the HTTP service of BLU-IC2 and BLU-IC4 access-control appliances running firmware 1.19.5 or earlier cause the devices to return HTTP 5xx responses that can leak implementation details, an information-disclosure weakness classified as CWE-394 (Unexpected Status Code or Return Value). The authoritative assessment scores this CVSS 3.1 as AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - unauthenticated network reachability, no user interaction, low confidentiality impact only - while the published CVSS 4.0 score of 10.0 asserts high confidentiality, integrity and availability impact across scope; that discrepancy is material and must be resolved before prioritization. No public exploit code and no CISA KEV entry were identified at time of analysis, though the appliances are typically segmented on physical-security networks rather than internet-exposed.
Systemic HTTP 500 error responses in Azure Access BLU-IC2 and BLU-IC4 access controller firmware through version 1.19.5 can be induced by remote, unauthenticated requests, resulting in limited information exposure and partial availability impact as assessed under CVSS 3.1 (C:L/I:N/A:L). The condition stems from improper handling of unexpected status codes or return values (CWE-394) and affects specialized physical access control appliances. No public exploit code or CISA KEV entry was identified at time of analysis, and practical risk is narrowed by the devices' typical deployment on internal or restricted facility networks rather than the public internet.
Cross-site request forgery in Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5 allows remote attackers to induce an authenticated administrator to submit forged state-changing requests to the web management interface because anti-CSRF tokens are not implemented. Exploitation requires a concurrent privileged session and victim interaction, so the supplied CVSS 4.0 score of 10.0 is likely inflated; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. No public exploit was identified at time of analysis, and EPSS is 0.17% (percentile 6%).
BLU-IC2 and BLU-IC4 firmware through version 1.19.5 ships with a non-compliant TLS configuration (CWE-326, inadequate encryption strength), meaning transport sessions can be protected by deprecated protocol versions, weak cipher suites, or insufficient key lengths. An attacker who can obtain a man-in-the-middle position on the network path between a client and the device could intercept, downgrade, or manipulate those sessions to disclose or alter data in transit. The vendor assigns a maximum 10.0 CVSS 4.0 score, but exploitation realistically depends on an on-path presence rather than direct remote access to an exposed service, integrity impact is limited, and no public exploit has been identified at time of analysis; EPSS is 0.24% (14th percentile).
Unauthenticated remote attackers can retrieve server version information from Azure Access BLU-IC2 and BLU-IC4 physical access-control intercom appliances running firmware 1.19.5 or earlier, exposing fingerprinting data that aids follow-on targeting. The CWE-306 classification (Missing Authentication for Critical Function) hints that the underlying weakness may be a missing authentication check rather than a purely cosmetic banner leak, but the description as written establishes only version disclosure, and our assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - confidentiality-only, no integrity or availability impact. EPSS is 0.35% (27th percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis; the practical risk is gated almost entirely by whether these appliances are reachable from untrusted networks.
Unauthenticated remote access to a critical function in Azure Access BLU-IC2/IC4 firmware through 1.19.5 lets a network attacker reach privileged functionality without credentials, with high impact to confidentiality, integrity, and availability on the device and on subsequent systems. The CVSS 4.0 base score is 10.0, matching the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), so practical risk is driven mainly by whether the management/network interface is reachable; EPSS is low at 0.34% (26th percentile) and no public exploit identified at time of analysis.
Privilege escalation in Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5 lets an attacker with an existing low-privileged foothold gain full device control via an improper privilege-management flaw (CWE-269). The independent assessment scores this CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, requiring local access or low privileges, while the input CVSS 4.0 AV:N/PR:N/10.0 claim conflicts with the 'Local Privilege Escalation' description and should be confirmed with the vendor; EPSS is 0.22% (11th percentile) and no public exploit is identified at time of analysis.
Local privilege escalation in Azure Access BLU-IC2 and BLU-IC4 intercom firmware through 1.19.5 allows a lower-privileged local user to abuse a misconfigured SUID-bit binary and obtain elevated privileges. The authoritative assessment rates this as local, low-complexity, low-privilege exploitation (CVSS 3.1 AV:L/PR:L), which conflicts with the supplied CVSS 4.0 network/no-auth vector and should take precedence for prioritization. EPSS is 0.34% (26th percentile), and no CISA KEV entry or public exploit code is identified in the provided data.
Denial of service in Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5 allows unauthenticated network attackers who can reach the device's protocol/communication interface to crash or hang the appliance via crafted protocol manipulation. The authoritative assessment limits impact to availability loss (C:N/I:N/A:H) and does not support the headline CVSS 4.0 score of 10.0, which claims high confidentiality, integrity, and subsequent-system impact. No public exploit or CISA KEV confirmation was identified at time of analysis, and EPSS is low at 0.34% (25th percentile).
Arbitrary file write via path traversal in the firmware upgrade feature of Azure Access BLU-IC2 and BLU-IC4 boards (firmware through 1.19.5) allows unauthenticated, network-accessible attackers to write files to arbitrary locations, potentially gaining super-user permissions on the device. The vendor CVSS 4.0 vector rates this 10.0 with high impact to both the vulnerable system and subsequent systems, though the independent assessment notes that upgrade interfaces are often administrative and may in practice require authentication or management-network access. No public exploit identified at time of analysis; EPSS is low at 0.48% (40th percentile).
Error output produced by the web management interface of BLU-IC2 and BLU-IC4 access-control appliances (firmware through 1.19.5) is wrapped into HTTP response headers, disclosing sensitive diagnostic detail to any remote client able to induce a failure condition. The CVSS 4.0 base score is 6.9, but our assessment bounds real impact to low-confidentiality information disclosure - no code execution, data modification, or denial of service - on appliances that are normally deployed on internal or segmented networks. No public exploit code or active exploitation has been identified at time of analysis (EPSS 0.25%, 15th percentile).
Weak password policy in Azure Access BLU-IC2 and BLU-IC4 intercom access controller firmware through version 1.19.5 can make management credentials guessable, allowing brute-force or credential-guessing attacks that, if successful, could expose sensitive information and enable high-impact configuration changes. The supplied CVSS 4.0 score is 10.0, but the independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H because exploitation depends on a weak credential actually being present and the authentication interface being reachable. No public exploit identified at time of analysis, and EPSS is low at 0.34% (26th percentile).
Email/SMTP password disclosure in Azure Access BLU-IC2 and BLU-IC4 intercom firmware through 1.19.5 allows unauthenticated remote attackers with network reachability to retrieve stored email account credentials, but only on units where an email/SMTP account is configured. No public exploit code was identified at time of analysis, and EPSS is low at 0.32% (23rd percentile). The reported CVSS 4.0 score of 10.0 conflicts with the assessed CVSS 3.1 confidentiality-only impact (C:H/I:N/A:N) and with the practical prerequisites of network exposure and a configured email account.
BLU-IC2 and BLU-IC4 access-control/intercom units running firmware 1.19.5 or earlier ship with a factory default password and never force the operator to replace it during initial provisioning, so anyone who can reach the management interface with the publicly known default credentials gains full administrative control of the device. The flaw is unauthenticated from the attacker's perspective (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C with high confidentiality, integrity and availability impact to both the device and connected systems) and carries a CVSS 4.0 base score of 10.0. Exploitation is not confirmed in the wild (not in CISA KEV) and no public exploit code has been identified at time of analysis, while EPSS sits at 0.34% (26th percentile) - real-world risk is driven almost entirely by whether the management interface of these specialized building-network devices is reachable from untrusted networks.
Improper input validation in the web management interface of Azure Access BLU-IC2 and BLU-IC4 access-control/intercom appliances running firmware 1.19.5 and earlier lets unauthenticated remote attackers submit crafted input that yields limited confidentiality, integrity, and availability impact (CVSS 4.0 base 6.9; vendor-tagged as an information disclosure issue). Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) no credentials or user interaction are required, so exposure is governed almost entirely by whether the device's web UI is reachable - these appliances normally sit on internal or management networks rather than the public internet. Risk is moderate and low-urgency: EPSS is 0.19% (9th percentile) and no public exploit code or CISA KEV entry was identified at time of analysis.
BLU-IC2 and BLU-IC4 firmware through 1.19.5 fail to terminate authenticated sessions on logout, letting an attacker who obtains or reuses an un-terminated session token retain management-interface access; despite the 6.9 CVSS 4.0 score, this is a moderate, low-priority issue. Exploitation requires a pre-existing authenticated session-typically on a shared or unattended terminal or via a stolen token-so the vendor's CVSS 4.0 PR:N rating overstates reachability; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS is 0.20% (10th percentile) and no public exploit was identified at time of analysis.
Unauthenticated remote command execution affects Azure Access BLU-IC2 and BLU-IC4 firmware through version 1.19.5, where attacker-supplied input that manipulates the device's mail configuration file is later processed in a way that executes injected OS commands. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H and SC/SI/SA:H) yields a maximum 10.0 base score and matches our independent CVSS 3.1 assessment of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, meaning no credentials and no user interaction are needed - the realistic barrier is network reachability of the appliance's management/mail-configuration interface. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.54% (44th percentile), so exposure is dominated by whether these devices are internet-facing rather than by observed exploitation.
The BLU-IC2 and BLU-IC4 firmware through 1.19.5 ship the outdated BusyBox 1.31.1 userland, exposing an aggregated set of known BusyBox weaknesses tracked as CVE-2025-12221. Exploitation requires a low-privilege authenticated attacker, a non-default attack prerequisite, and passive user interaction, with low confidentiality, integrity, and availability impact. No public exploit code or CISA KEV active exploitation is identified, and EPSS is 0.17% (5th percentile), making this a low-priority issue across nearly all signals.
Network-reachable BLU-IC2 and BLU-IC4 devices running firmware through 1.19.5 embed BusyBox 1.31.1 and are exposed to multiple known BusyBox weaknesses that can compromise confidentiality, integrity, and availability. The vendor's CVSS 4.0 score is 10.0, but our assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N with high C/I/A impact because exploitation depends on reaching a specific network-facing BusyBox service or applet whose identity is not confirmed. EPSS is 0.37% (29th percentile) and no public exploit identified at time of analysis.
Azure Access OS firmware through 1.19.5 on BLU-IC2 and BLU-IC4 physical access controllers contains unspecified vulnerable components that expose the devices to a maximum-severity network attack. The supplied CVSS 4.0 vector (10.0) describes a remote, unauthenticated, low-complexity compromise with high confidentiality, integrity, and availability impact on both the vulnerable device and subsequent systems, although the exact vulnerable feature and prerequisites are not disclosed and these controllers are typically confined to internal building-management networks. No public exploit was identified at time of analysis and EPSS is 0.37% (29th percentile), so near-term exploitation likelihood is assessed as low despite the critical score.
BLU-IC2 and BLU-IC4 access-control appliances running firmware 1.19.5 or earlier ship with factory-default credentials that, when left unchanged, let any remote attacker who can reach the device log in with publicly guessable values and take full administrative control (CWE-1392). Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), no account or user interaction is required and the scope change means compromised appliances can be leveraged against downstream systems they gate - meaningful for devices of this class that are frequently internet-facing or on lightly segmented networks. The risk signals conflict sharply: a maximum-severity CVSS 4.0 base score of 10.0 and full C/I/A loss sit against a low EPSS of 0.30% (21st percentile) and no CISA KEV entry or public exploit code identified at time of analysis, so the practical risk is dominated entirely by whether an operator has actually rotated the defaults. The primary limiting factor is remediation state, not attacker capability: environments that have already changed default credentials are not exploitable via this vector.
BLU-IC2 and BLU-IC4 building-access appliance firmware (through 1.19.5) ships with the SNMP community string left at the factory default 'public', letting remote attackers who can reach UDP/161 query the device for information. No public exploit code has been identified at time of analysis, and EPSS is low at 0.30% (21st percentile). This is a genuine but modest-severity exposure, not a top-tier emergency: impact is bounded to what read-only SNMP data the 'public' community exposes, and exploitation is defeated entirely if administrators have changed the community string, disabled SNMP, or firewalled the service.
Persistent denial of service affects Azure Access BLU-IC2 and BLU-IC4 firmware through 1.19.5: a malicious or malformed installed app cannot be uninstalled, leaving the device unavailable. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) indicates network-reachable, authenticated low-privilege exploitation, while the vendor's CVSS 4.0 vector claims PR:N and broader impact; authentication requirements for the app-installation function should be confirmed against the vendor advisory. No public exploit was identified at time of analysis, KEV status is not indicated, and EPSS is 0.22% (11th percentile), suggesting low observed exploitation likelihood.
BLU-IC2 and BLU-IC4 firmware through 1.19.5 contain undocumented administrative accounts that allow network-reachable attackers to obtain administrative control without legitimate authentication, as reflected by the PR:N vector. Successful exploitation can fully compromise the confidentiality, integrity, and availability of the terminal and, because the assessed scope is changed, may affect connected systems. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.34% (26th percentile), but the potential impact remains severe.
Information disclosure through an enabled serial console on BLU-IC2 and BLU-IC4 devices (firmware through 1.19.5) lets someone with physical access to the device's serial interface observe diagnostic and boot-level output that can reveal further weaknesses and ease follow-on research or attack development. The vendor's own CVSS 4.0 vector scores this 5.2 with AV:L/AC:H/PR:N/UI:P, meaning unauthenticated but local (physically adjacent) access, high attack complexity, and only low confidentiality/integrity/availability impact to the device itself; our independent assessment corroborates this as a genuinely low-priority issue (CVSS 3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). There is no KEV listing and no public exploit code identified at time of analysis, and EPSS is only 0.11% (1st percentile), so remote or scaled exploitation is not a realistic concern - the real risk is an attacker who already has hands on the hardware.
Outdated third-party UI dependencies in BLU-IC2 and BLU-IC4 firmware through 1.19.5 can expose the management web interface to remote, unauthenticated exploitation, primarily risking information disclosure with lower integrity and availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.41% (34th percentile). Real-world exposure is limited by reachability of the device UI, since these access-control appliances are often segmented onto internal or restricted networks.
Session cookies issued by the BLU-IC2 and BLU-IC4 device web interfaces (firmware through 1.19.5) are set without the Secure and HttpOnly attributes, so any party able to run JavaScript inside the device's web context or to intercept cleartext HTTP traffic can read those cookies and replay them to hijack an authenticated administrative session. Exploitation is not standalone: it requires a pre-existing script-injection (XSS) foothold or a network man-in-the-middle position, plus a live authenticated session cookie and reachability to the web UI, so despite the raw CVSS 4.0 score of 5.3 the practical risk is low-to-moderate. No public exploit code was identified at time of analysis, the issue is not KEV-listed, and EPSS is only 0.21% (10th percentile).
Stored cross-site scripting in BLU-IC2 and BLU-IC4 firmware through 1.19.5 allows an attacker who can introduce an unsanitized application manifest to execute script in a victim's browser session when the stored content is rendered. The vendor CVSS 4.0 score is 10.0, but the independent assessment is CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating some management access plus user interaction are required; EPSS is low at 0.19% (9th percentile), and no public exploit was identified at time of analysis.
BLU-IC2 and BLU-IC4 firmware through 1.19.5 can return API responses with a text/html Content-Type instead of application/json, allowing HTML/JavaScript injection into the reply and script execution in a victim's browser session when the crafted response is loaded. The issue is network-reachable and unauthenticated from the request perspective but requires victim interaction (UI:R); it is not direct firmware code execution. No public exploit code or active exploitation has been identified (EPSS 0.26%, 16th percentile), and the independent assessment rates impact as limited confidentiality/integrity with no availability effect.
Denial-of-service conditions in Azure Access Technology BLU-IC2 and BLU-IC4 firmware through 1.19.5 allow remote attackers to exhaust device resources by sending sustained request floods, potentially making physical access-control and intercom services unavailable. NVD's CVSS 4.0 vector scores this 10.0 with high confidentiality, integrity, and availability impact, but the independent assessment finds only availability impact (CVSS 3.1 7.5), so confidentiality and integrity effects should be treated as unconfirmed. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.37% (29th percentile).