CVE-2025-12422criticalCWE-22

CVE-2025-12422: critical vulnerability in Azure Access Technology BLU-IC2

Vulnerable Upgrade Feature (Arbitrary File Write)

Published

Follow this CVE+ Monitor BLU-IC2+ Monitor BLU-IC4

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10epss 0.5%
In short

A flaw in the upgrade feature allows attackers to write arbitrary files to the system, potentially gaining super user permissions on BLU-IC2 and BLU-IC4 devices. This is a critical vulnerability that can completely compromise device security.

Technical detail

CWE-22 path traversal vulnerability in the upgrade mechanism of BLU-IC2 (≤1.19.5) and BLU-IC4 (≤1.19.5) allows unauthenticated or low-privileged attackers to write arbitrary files to the filesystem, resulting in privilege escalation to super user. No additional preconditions beyond access to the upgrade feature are required.

Summary generated and translated by AI from the official description.
Vulnerable Upgrade Feature (Arbitrary File Write) may lead to obtaining super user permissions on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Azure Access Technology · BLU-IC2Azure Access Technology · BLU-IC4
Related CVEs — Azure Access Technology BLU-IC2

In the same product, most dangerous first.

CVE-2025-12275CRITICALMail Configuration File Manipulation + Command ExecutionEPSS 0.5%CVE-2025-12599CRITICALMultiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)EPSS 0.4%CVE-2025-12104CRITICALIncorrect Content-Type HeaderEPSS 0.4%CVE-2025-12600CRITICALWeb UI MalfunctionEPSS 0.4%CVE-2025-12554MEDIUMMissing Security HeadersEPSS 0.4%CVE-2025-12516CRITICALLack of Graceful Error Handling - HTTP 5xx ErrorEPSS 0.4%