CVE-2025-12552: medium-severity vulnerability in Azure Access Technology BLU-IC2
Insufficient Password Policy
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The BLU-IC2 and BLU-IC4 systems allow weak passwords to be set because they do not enforce strong password requirements. This makes it easier for attackers to guess or crack user credentials and gain unauthorized access.
An insufficient password policy vulnerability exists in BLU-IC2 and BLU-IC4 through version 1.19.5, where the system fails to enforce adequate password complexity requirements. An unauthenticated attacker can set weak credentials during account creation or password reset, reducing resistance to brute-force and dictionary attacks. The vulnerability enables compromise of user accounts with minimal attack effort.
In the same product, most dangerous first.