CVE-2025-11925

The affected API returns responses with the Content-Type header set to text/html instead of the correct application/json. The browser or HTTP client interprets the response content as HTML, which opens the possibility of embedding and executing malicious HTML or JavaScript code in the context of that response. The error is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions), which means a lack of proper verification and sanitization of API output data.

An attacker can potentially inject and execute malicious HTML/JavaScript code in the victim's browser (XSS), which may lead to session hijacking, credential theft, or execution of unauthorized actions on behalf of the user. The full CVSS 10.0 vector indicates a possible critical impact on confidentiality, integrity, and availability of both the target system and related systems.

Apply patches available from the manufacturer in accordance with references published at https://azure-access.com/security-advisories. Until the update is applied, it is recommended to restrict access to affected APIs only to trusted networks and monitor network traffic for suspicious responses.

Azure-Access BLU-IC2 in versions up to and including 1.19.5 and Azure-Access BLU-IC4 in versions up to and including 1.19.5 (along with corresponding firmware versions).