Undocumented Administrative Accounts

The system was secretly creating hidden administrative accounts to allow applications to access sensitive functions. This is critical because attackers could discover and use these accounts to take complete control of the device.

Undocumented administrative accounts are automatically provisioned without user knowledge or documentation, enabling unauthorized privilege escalation. An attacker who discovers these accounts can bypass authentication mechanisms and gain unrestricted administrative access to affected BLU-IC2 and BLU-IC4 devices running versions up to 1.19.5.