CVE-2025-12554: medium-severity vulnerability in Azure Access Technology BLU-IC2
Missing Security Headers
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The BLU-IC2 and BLU-IC4 software versions up to 1.19.5 are missing important security headers that web browsers use to protect against common attacks like clickjacking and data theft. Without these headers, the application is more vulnerable to certain web-based attacks.
Missing security headers (CWE-693) in BLU-IC2 and BLU-IC4 through v1.19.5 fails to implement HTTP response headers such as X-Frame-Options, X-Content-Type-Options, and Content-Security-Policy that mitigate client-side attacks. An attacker can leverage this to perform clickjacking, MIME-type sniffing, or injection attacks without server-enforced protections in place.
In the same product, most dangerous first.