CVE-2025-12285

The vulnerability classified as CWE-521 (weak password policy) and CWE-20 (insufficient input validation) consists of the absence of a mechanism enforcing the change of factory/default password after first login. An attacker possessing knowledge of the manufacturer's default credentials can gain access to the device without any additional prerequisites, as access is possible directly over the network without special authentication. A network attack vector (AV:N) with no complexity requirements (AC:L) and no privileges required (PR:N) makes the exploit trivial to perform.

An attacker can gain full control of the device, including access to sensitive data, ability to modify configuration, and potential impact on systems connected to it. In the case of access control devices, this may result in a breach of physical security of the facility.

Apply patches available from the manufacturer according to references (https://azure-access.com/security-advisories). Until firmware is updated, immediately manually change the device's default password to a strong, unique password and restrict network access to the devices exclusively to trusted hosts (e.g., via firewall or network segmentation).

Azure-Access BLU-IC2 in all firmware versions up to and including 1.19.5 and Azure-Access BLU-IC4 in all firmware versions up to and including 1.19.5.