CVE-2025-12423

An attacker can remotely send crafted data or protocol requests to the vulnerable device, leading to its malfunction or complete downtime. The attack requires no privileges, user interaction, or additional conditions on the attacker's side. The vulnerability is classified as CWE-248, indicating an unhandled exception that can be triggered externally.

An attacker can render the device unavailable (denial of service), interrupting its operation and potentially disrupting physical access control or other critical functions supported by these devices.

Patches available from the manufacturer should be applied in accordance with the references published at https://azure-access.com/security-advisories. Until updates are applied, it is recommended to restrict network access to BLU-IC2 and BLU-IC4 devices, for example through network segmentation or by implementing firewall rules blocking unauthorized traffic.

Azure-Access BLU-IC2 in all versions up to and including 1.19.5, and Azure-Access BLU-IC4 in all versions up to and including 1.19.5 (device firmware and software).