CVE-2025-12104criticalCWE-1104

CVE-2025-12104: critical vulnerability in Azure Access Technology BLU-IC2

Incorrect Content-Type Header

Published

Follow this CVE+ Monitor BLU-IC2+ Monitor BLU-IC4

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10epss 0.4%
In short

The application uses outdated UI libraries that contain known security vulnerabilities, which could allow attackers to exploit weaknesses in these components. This affects certain versions of BLU-IC2 and BLU-IC4 systems.

Technical detail

CWE-1104 addresses use of outdated or vulnerable third-party UI dependencies that may contain exploitable flaws. Affected versions (BLU-IC2 and BLU-IC4 through 1.19.5) have not patched vulnerable library components, potentially enabling remote code execution or unauthorized access depending on the specific vulnerability in the dependency.

Summary generated and translated by AI from the official description.
Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Azure Access Technology · BLU-IC2Azure Access Technology · BLU-IC4
Related CVEs — Azure Access Technology BLU-IC2

In the same product, most dangerous first.

CVE-2025-12275CRITICALMail Configuration File Manipulation + Command ExecutionEPSS 0.5%CVE-2025-12422CRITICALVulnerable Upgrade Feature (Arbitrary File Write)EPSS 0.5%CVE-2025-12599CRITICALMultiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)EPSS 0.4%CVE-2025-12600CRITICALWeb UI MalfunctionEPSS 0.4%CVE-2025-12554MEDIUMMissing Security HeadersEPSS 0.4%CVE-2025-12516CRITICALLack of Graceful Error Handling - HTTP 5xx ErrorEPSS 0.4%