CVE-2025-12515criticalCWE-394

CVE-2025-12515: critical vulnerability in Azure Access Technology BLU-IC2

Systemic Internal Server Errors - HTTP 500 Response

Published

Follow this CVE+ Monitor BLU-IC2+ Monitor BLU-IC4

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10epss 0.4%
In short

A critical flaw causes the BLU-IC2 and BLU-IC4 systems (versions up to 1.19.5) to repeatedly crash with internal server errors (HTTP 500), making them completely unavailable. This prevents legitimate users from accessing the service at all.

Technical detail

A systemic exception handling failure in BLU-IC2 and BLU-IC4 up to 1.19.5 triggers persistent HTTP 500 errors on routine requests, resulting in denial of service. The vulnerability stems from improper error handling (CWE-394) that crashes the application without graceful recovery, affecting availability with no authentication requirement.

Summary generated and translated by AI from the official description.
Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Azure Access Technology · BLU-IC2Azure Access Technology · BLU-IC4
Related CVEs — Azure Access Technology BLU-IC2

In the same product, most dangerous first.

CVE-2025-12275CRITICALMail Configuration File Manipulation + Command ExecutionEPSS 0.5%CVE-2025-12422CRITICALVulnerable Upgrade Feature (Arbitrary File Write)EPSS 0.5%CVE-2025-12599CRITICALMultiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)EPSS 0.4%CVE-2025-12104CRITICALIncorrect Content-Type HeaderEPSS 0.4%CVE-2025-12600CRITICALWeb UI MalfunctionEPSS 0.4%CVE-2025-12554MEDIUMMissing Security HeadersEPSS 0.4%