CVE-2025-12516

The vulnerability results from improper or completely absent error handling on the HTTP server side embedded in the firmware of BLU-IC2 and BLU-IC4 devices. In accordance with CWE-394, the lack of graceful error handling means that the application does not respond correctly to 5xx class error conditions, which can lead to unexpected device states or disclosure of sensitive information. The attack vector is network-based, requires no authentication or user interaction, making the vulnerability trivial to exploit remotely.

An attacker without any privileges, acting remotely over the network, can compromise the confidentiality, integrity, and availability of both the targeted device and systems associated with it, potentially gaining full control over the access infrastructure.

Apply patches available from the manufacturer in accordance with references published at https://azure-access.com/security-advisories. Until firmware updates are applied, it is recommended to restrict network access to BLU-IC2 and BLU-IC4 devices exclusively to trusted hosts and implement network segmentation.

Azure-Access BLU-IC2 with firmware version up to and including 1.19.5, and Azure-Access BLU-IC4 with firmware version up to and including 1.19.5.