CVE-2025-12104

The vulnerability results from the use of outdated UI library components (CWE-1104 — Use of Unmaintained Third-Party Components) in the BLU-IC2 and BLU-IC4 device software. Such components may contain known security vulnerabilities that have not been patched by the manufacturer and can be exploited remotely without requiring authentication. The attack vector indicates that the exploit can be conducted over the network without user interaction and without required privileges.

Successful exploitation of the vulnerability may allow an attacker to gain full control of the device, and potentially compromise the confidentiality, integrity, and availability of both the device itself and associated systems.

Patches available from the manufacturer should be applied in accordance with references published on https://azure-access.com/security-advisories. It is recommended to update device software to version 1.19.5 or above immediately.

Azure-Access BLU-IC2 in versions up to and including 1.19.5, and Azure-Access BLU-IC4 in versions up to and including 1.19.5.