CVE-2025-12364

The vulnerability consists of the lack or insufficient enforcement of strong passwords in the firmware of BLU-IC2 and BLU-IC4 devices (CWE-521: Weak Password Requirements). An attacker without any prior privileges can gain remote access to the device over the network and without user interaction by exploiting weak or default passwords. The attack vector does not require special conditions or advanced techniques, making the attack very simple to carry out.

An attacker can gain full control over the device, leading to violations of confidentiality, integrity, and availability of both the device itself and systems associated with it. Due to the maximum impact values also on secondary systems (SC:H, SI:H, SA:H), a compromise may have serious consequences for the entire network infrastructure.

Patches available from the manufacturer must be applied in accordance with references published at https://azure-access.com/security-advisories. Until firmware updates are applied, it is recommended to isolate devices from public networks, enforce strong and unique password changes, and restrict device access exclusively to trusted network segments.

Azure-Access BLU-IC2 with firmware up to and including version 1.19.5 and Azure-Access BLU-IC4 with firmware up to and including version 1.19.5.