CVE-2025-12515

The vulnerability results from improper error handling of the internal HTTP server embedded in the firmware of BLU-IC2 and BLU-IC4 devices. The server systematically (i.e., repeatedly and predictably) generates HTTP 500 responses, which according to CWE-394 indicates inappropriate application response to error conditions. The attack vector is network-based, requires no authentication, user interaction, or special conditions (AC:L, PR:N, UI:N), making the vulnerability trivial to exploit remotely.

An attacker can potentially cause complete loss of confidentiality, integrity, and availability of both the attacked system and related systems (SC:H, SI:H, SA:H in the CVSS vector). The scope of impact also includes components external to the vulnerable device.

Patches available from the manufacturer should be applied in accordance with references published at https://azure-access.com/security-advisories. Until firmware is updated, it is recommended to restrict network access to BLU-IC2 and BLU-IC4 devices only to trusted hosts and isolate devices in dedicated network segments (VLANs) with firewall rules applied.

Azure-Access BLU-IC2 with firmware version 1.19.5 and earlier, and Azure-Access BLU-IC4 with firmware version 1.19.5 and earlier.