CVE-2025-12218

The vulnerability consists of the fact that the firmware of BLU-IC2 and BLU-IC4 devices contains weak default credentials that are likely not enforced to be changed by the user during configuration. An attacker can remotely, without authentication and without user interaction, exploit these known or easily guessable login credentials to gain access to the device. A network attack vector (AV:N) combined with no required privileges (PR:N) and interaction (UI:N) makes the attack simple to execute at scale.

An attacker can gain full control over the device, resulting in compromise of confidentiality, integrity, and availability of both the system itself and associated network resources (SC:H/SI:H/SA:H). This can lead to unauthorized access to physical access control infrastructure, modification of its configuration, or use of devices as an entry point to the internal network.

Apply patches available from the manufacturer according to the references (https://azure-access.com/security-advisories). Until firmware is updated, immediately change default credentials to strong, unique passwords, restrict network access to devices using firewalls or network segmentation, and disable remote access if not required.

Azure-Access BLU-IC2 with firmware version up to and including 1.19.5 and Azure-Access BLU-IC4 with firmware version up to and including 1.19.5.