Insufficient Password Policy

The BLU-IC2 and BLU-IC4 systems allow weak passwords to be set because they do not enforce strong password requirements. This makes it easier for attackers to guess or crack user credentials and gain unauthorized access.

An insufficient password policy vulnerability exists in BLU-IC2 and BLU-IC4 through version 1.19.5, where the system fails to enforce adequate password complexity requirements. An unauthenticated attacker can set weak credentials during account creation or password reset, reducing resistance to brute-force and dictionary attacks. The vulnerability enables compromise of user accounts with minimal attack effort.