CVE-2025-12601

The SlowLoris technique involves maintaining a large number of HTTP connections open for as long as possible by sending request headers slowly. The HTTP server on the vulnerable device exhausts the pool of available connections and stops responding to new requests. The vulnerability does not require authentication or any user interaction, and the attack can be performed remotely over the network (AV:N, AC:L).

An attacker can completely disable network services on the device (Denial of Service), which in access control environments can result in inability to manage the device and potentially disrupt physical access control functions.

Apply patches available from the manufacturer according to references published at https://azure-access.com/security-advisories. Until updates are deployed, it is recommended to restrict network access to the device management interface only to trusted hosts (e.g., through firewall or network segmentation).

Azure-Access BLU-IC2 in versions up to and including 1.19.5 and Azure-Access BLU-IC4 in versions up to and including 1.19.5 (along with corresponding firmware).