CVE-2025-12553

The firmware of BLU-IC2 and BLU-IC4 devices does not verify the SMTP/email server certificate when establishing a connection. The absence of this verification means that the device accepts any certificate — including fake or self-signed ones — without confirming the server's identity. An attacker positioned on the network communication path can perform a man-in-the-middle attack, intercepting or modifying transmitted data without the knowledge of the device or administrator.

An attacker can intercept confidential data transmitted via email by the device (e.g., alerts, configuration data, credentials) or substitute a fake mail server and manipulate communications, which may lead to system compromise and the environment in which the device operates.

Apply patches available from the manufacturer in accordance with references published at https://azure-access.com/security-advisories. Until updates are applied, it is recommended to isolate devices on the network and monitor email traffic generated by these devices.

Azure-Access BLU-IC2 in all firmware versions up to and including 1.19.5 and Azure-Access BLU-IC4 in all firmware versions up to and including 1.19.5.