CVE-2025-11832

BLU-IC2 and BLU-IC4 devices do not implement mechanisms for limiting or controlling network resource allocation. An attacker, remotely and without any privileges, can send an excessive number of requests or connections, causing device resource exhaustion. The lack of throttling or limits on the device side makes a flooding attack possible by any network entity.

An attacker can cause the device to become unavailable (denial of service), and due to the maximum impact on the confidentiality, integrity and availability of both the system and its environment — potentially also lead to loss of control over the device and systems associated with it.

Patches available from the manufacturer should be applied in accordance with the references published at https://azure-access.com/security-advisories. Until updates are deployed, it is recommended to restrict network access to BLU-IC2 and BLU-IC4 devices only to trusted hosts through firewall rules or network segmentation.

Azure Access Technology BLU-IC2 in all firmware versions up to and including 1.19.5 and Azure Access Technology BLU-IC4 in all firmware versions up to and including 1.19.5.