CVE-2025-12001

An attacker can provide a maliciously crafted application manifest that is not properly validated or sanitized by the device software. As a result of improper input processing (CWE-20), the malicious script is permanently stored in the system (stored XSS, CWE-79) and is executed in the context of the victim's browser each time the infected content is displayed. The lack of user interaction required on the attacker's side and the absence of required permissions make the attack remotely exploitable and fully automated.

An attacker can execute arbitrary JavaScript code in the context of a logged-in user's session, which may lead to account takeover, theft of authentication credentials, manipulation of the device interface, and potential control over both the client-side system and network infrastructure.

Apply patches available from the manufacturer according to references published at https://azure-access.com/security-advisories. Until an update is applied, it is recommended to restrict access to device management panels only to trusted networks and to implement network segmentation.

Azure-Access BLU-IC2 in versions up to and including 1.19.5 and Azure-Access BLU-IC4 in versions up to and including 1.19.5 (along with their corresponding firmware).