CVE-2025-12476: critical vulnerability in Azure Access Technology BLU-IC2
Resource Lacking AuthN
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 0.3%
In short
A critical flaw in BLU-IC2 and BLU-IC4 (up to version 1.19.5) allows attackers to access protected resources without providing valid credentials. This means sensitive data or functions can be accessed by anyone without authentication.
Technical detail
CWE-306 vulnerability where critical resources lack proper authentication controls in BLU-IC2 and BLU-IC4 versions ≤1.19.5. An unauthenticated attacker can directly access protected endpoints or resources, resulting in unauthorized data exposure and potential system compromise.
Summary generated and translated by AI from the official description.
Resource Lacking AuthN.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Related CVEs — Azure Access Technology BLU-IC2
In the same product, most dangerous first.
CVE-2025-12275CRITICALMail Configuration File Manipulation + Command ExecutionEPSS 0.5%CVE-2025-12422CRITICALVulnerable Upgrade Feature (Arbitrary File Write)EPSS 0.5%CVE-2025-12599CRITICALMultiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)EPSS 0.4%CVE-2025-12104CRITICALIncorrect Content-Type HeaderEPSS 0.4%CVE-2025-12600CRITICALWeb UI MalfunctionEPSS 0.4%CVE-2025-12554MEDIUMMissing Security HeadersEPSS 0.4%