CVE-2025-12114: medium-severity vulnerability in Azure Access Technology BLU-IC2
Serial Console Enabled
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.2epss 0.1%
In short
The serial console is left enabled on affected devices, potentially exposing sensitive information that attackers could use to discover other vulnerabilities in the system.
Technical detail
An enabled serial console (CWE-1191: Information Exposure Through Serialized Data) allows unauthenticated access to debug output and system information via serial interface, facilitating reconnaissance for further exploitation. This affects BLU-IC2 and BLU-IC4 firmware versions up to 1.19.5.
Summary generated and translated by AI from the official description.
Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H
Related CVEs — Azure Access Technology BLU-IC2
In the same product, most dangerous first.
CVE-2025-12275CRITICALMail Configuration File Manipulation + Command ExecutionEPSS 0.5%CVE-2025-12422CRITICALVulnerable Upgrade Feature (Arbitrary File Write)EPSS 0.5%CVE-2025-12599CRITICALMultiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)EPSS 0.4%CVE-2025-12104CRITICALIncorrect Content-Type HeaderEPSS 0.4%CVE-2025-12600CRITICALWeb UI MalfunctionEPSS 0.4%CVE-2025-12554MEDIUMMissing Security HeadersEPSS 0.4%