CVE-2025-12425

The vulnerability consists of improper privilege handling in the firmware of BLU-IC2 and BLU-IC4 devices in versions up to and including 1.19.5. An attacker with local access to the device can exploit this vulnerability to obtain higher system privileges than those to which they are entitled. The detailed mechanism has not been disclosed in the manufacturer's description, however, classification as CWE-269 suggests improper control of privilege granting or delegation.

Successful exploitation of this vulnerability allows an attacker to gain full control of the device with elevated privileges, which may lead to data compromise, manipulation of device configuration, and potentially lateral movement within the network to which the device is connected.

Security patches available from the manufacturer should be applied in accordance with references published at https://azure-access.com/security-advisories. Until firmware is updated, physical and local access to devices should be restricted exclusively to authorized personnel.

Azure-Access BLU-IC2 (firmware version up to and including 1.19.5) and Azure-Access BLU-IC4 (firmware version up to and including 1.19.5).