CVE-2025-12422

The vulnerability classified as CWE-22 (path traversal) exists in the firmware update handling function. An unauthenticated remote attacker can deliver a crafted update package containing paths with '../' sequences that allow writing files outside the allowed target directory. This makes it possible to overwrite critical system files or place malicious files anywhere on the device's file system.

Successful exploitation of this vulnerability leads to obtaining superuser (root) privileges on the device, which means complete takeover of the device by the attacker.

Apply patches available from the manufacturer according to references published at https://azure-access.com/security-advisories. Until the update is applied, it is recommended to isolate devices from untrusted networks and restrict network access to the firmware update interface exclusively to trusted hosts.

Azure-Access BLU-IC2 in all firmware versions up to and including 1.19.5 and Azure-Access BLU-IC4 in all firmware versions up to and including 1.19.5.