CVE-2025-12424

The vulnerability involves improper privilege management (CWE-269) — specifically improper use of the SUID (Set User ID) bit on a system binary file. The SUID bit causes the program to execute with the permissions of the file owner (typically root) rather than the permissions of the user invoking it. An attacker with system access can exploit this binary file to obtain elevated privileges without requiring authentication as an administrator.

An attacker can obtain full administrative (root) privileges on the device, enabling complete system takeover, configuration modification, access to protected data, and potentially compromising the network to which the device is connected.

Patches available from the manufacturer should be applied in accordance with references published at https://azure-access.com/security-advisories. Until the fix is implemented, it is recommended to restrict physical and network access to devices exclusively to trusted users and monitor attempts of unauthorized access.

Azure-Access BLU-IC2 in versions up to 1.19.5 (inclusive) and Azure-Access BLU-IC4 in versions up to 1.19.5 (inclusive), including corresponding firmware versions of these devices.