CVE-2025-12600

An attacker remotely, without authentication and without user interaction, sends a request to the device's API containing an unexpected value for the locale parameter. This causes malfunction of the device's Web UI. The network attack vector and lack of any prerequisites make this vulnerability trivially exploitable from any network location. CWE-730 indicates a possible issue with regular expressions vulnerable to catastrophic backtracking or similar input processing mechanism.

An attacker can cause serious malfunction of the device's Web UI, potentially resulting in loss of availability, integrity, and confidentiality of both the device itself and associated systems — in accordance with the maximum values of the CVSS 4.0 vector.

Patches available from the manufacturer should be applied in accordance with references published at https://azure-access.com/security-advisories. Until updates are deployed, it is recommended to restrict network access to the Web UI and API of devices to trusted hosts only and implement network segmentation.

Azure-Access BLU-IC2 in all firmware versions up to and including 1.19.5 and Azure-Access BLU-IC4 in all firmware versions up to and including 1.19.5.