CVE-2025-12477: critical vulnerability in Azure Access Technology BLU-IC2
Server Version Disclosure
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The server reveals its version number in responses, allowing attackers to identify what software and version is running. This makes it easier for attackers to find and exploit known vulnerabilities specific to that version.
Server version information is disclosed in HTTP headers or responses (CWE-306: Missing Authentication for Critical Function), enabling reconnaissance for targeted exploitation. Attackers can leverage this information to identify applicable CVEs without authentication, increasing attack surface for BLU-IC2 and BLU-IC4 versions through 1.19.5.
In the same product, most dangerous first.