CVE-2025-12601

Denial of Service Due to SlowLoris

Denial of Service Due to SlowLoris.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12114

Serial Console Enabled

Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12176

Undocumented Administrative Accounts

Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12216

Malicious / Malformed App can be Installed but not Uninstalled

Malicious / Malformed App can be Installed but not Uninstalled/may lead to unavailability.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12217

SNMP Default Community String (public)

SNMP Default Community String (public).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12218

Weak Default Credentials

Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12219

Vulnerable Components in Azure Access OS

Vulnerable Components in Azure Access OS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12220

Busybox 1.31.1 - Multiple Known Vulnerabilities

Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology Busybox

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 4 more

CVE-2025-12278

Logout Functionality not Working

Logout Functionality not Working.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12284

Lack of Input Validation

Lack of Input Validation in the web UI might lead to potential exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12285

Missing Initial Password Change

Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12363

Email Password Disclosure

Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12364

Weak Password Policy

Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12365

Error Messages Wrapped In HTTP Header

Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12515

Systemic Internal Server Errors - HTTP 500 Response

Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12516

Lack of Graceful Error Handling - HTTP 5xx Error

Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12517

Credits Page not Matching Versions in Use in the Firmware

Credits Page not Matching Versions in Use in the FirmwareThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12552

Insufficient Password Policy

Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12553

Server Certificate Verification Disabled

Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more

CVE-2025-12554

Missing Security Headers

Missing Security Headers.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Azure-access Azure Access Technology

Products

Blu-ic2 Blu-ic2 Firmware Blu-ic4 and 3 more