CVE-2025-12176: critical vulnerability in Azure Access Technology BLU-IC2
Undocumented Administrative Accounts
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The system was secretly creating hidden administrative accounts to allow applications to access sensitive functions. This is critical because attackers could discover and use these accounts to take complete control of the device.
Undocumented administrative accounts are automatically provisioned without user knowledge or documentation, enabling unauthorized privilege escalation. An attacker who discovers these accounts can bypass authentication mechanisms and gain unrestricted administrative access to affected BLU-IC2 and BLU-IC4 devices running versions up to 1.19.5.
In the same product, most dangerous first.