CVE-2025-12599

The vulnerability classified as CWE-321 (Use of Hard-coded Cryptographic Key) consists in the fact that all instances of BLU-IC2 and BLU-IC4 devices possess identical cryptographic secrets hardcoded in the firmware used for authentication or encryption of communication on TCP port 5000 (SDKSocket). An attacker who obtains knowledge of these secrets (for example through analysis of the firmware of one device) can impersonate an authorized client or decrypt network traffic of any other device from the same product line. The attack vector is network-based, requires no authentication or user interaction.

An attacker with network access to TCP port 5000 can gain full control over the device and potentially over systems associated with it, which includes violation of confidentiality, integrity, and availability of both the device itself and the systems communicating with it.

Patches available from the manufacturer should be applied according to the references (https://azure-access.com/security-advisories). Until updates are applied, it is recommended to block access to TCP port 5000 at the firewall level and restrict network access to devices only to trusted hosts.

Azure-Access BLU-IC2 in all firmware versions up to and including 1.19.5 and Azure-Access BLU-IC4 in all firmware versions up to and including 1.19.5.