CVE-2025-12285: critical vulnerability in Azure Access Technology BLU-IC2
Missing Initial Password Change
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 0.3%
In short
New devices come with a default password that users don't have to change when setting up, leaving them vulnerable to unauthorized access if someone knows the default credentials.
Technical detail
CWE-20 (Improper Input Validation) vulnerability in BLU-IC2 and BLU-IC4 (versions ≤1.19.5) where initial password change is not enforced during device provisioning. An unauthenticated attacker with network access can authenticate using known default credentials, bypassing authentication controls and gaining full device access.
Summary generated and translated by AI from the official description.
Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Related CVEs — Azure Access Technology BLU-IC2
In the same product, most dangerous first.
CVE-2025-12275CRITICALMail Configuration File Manipulation + Command ExecutionEPSS 0.5%CVE-2025-12422CRITICALVulnerable Upgrade Feature (Arbitrary File Write)EPSS 0.5%CVE-2025-12599CRITICALMultiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)EPSS 0.4%CVE-2025-12104CRITICALIncorrect Content-Type HeaderEPSS 0.4%CVE-2025-12600CRITICALWeb UI MalfunctionEPSS 0.4%CVE-2025-12554MEDIUMMissing Security HeadersEPSS 0.4%