CVE-2025-12478

The vulnerability results from the use of TLS configuration in the devices that does not meet current security standards (CWE-326). This means that the cryptographic algorithms used, key lengths, or connection negotiation parameters are insufficient. A remote attacker, without authentication and without special prerequisites, may potentially conduct an attack on the device communication encryption layer. This results in exposure of confidentiality, integrity, and availability of both the device itself and systems associated with it.

An attacker may gain access to sensitive data transmitted by the device, manipulate communications, or disrupt the operation of the device and connected systems. The maximum CVSS score of 10.0 indicates full impact on confidentiality, integrity, and availability of both the device itself and surrounding systems.

Security patches from the manufacturer should be applied in accordance with references published at https://azure-access.com/security-advisories. It is recommended to immediately update the firmware of BLU-IC2 and BLU-IC4 devices to a version higher than 1.19.5 as soon as it becomes available. Until the patch is deployed, it is recommended to isolate the devices on the network and restrict access to them exclusively to trusted network segments.

Azure-Access BLU-IC2 in all firmware versions up to and including 1.19.5, and Azure-Access BLU-IC4 in all firmware versions up to and including 1.19.5.