CVE-2025-12601criticalCWE-730

CVE-2025-12601: critical vulnerability in Azure Access Technology BLU-IC2

Denial of Service Due to SlowLoris

Published · Updated

Follow this CVE+ Monitor BLU-IC2+ Monitor BLU-IC4

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10epss 0.3%
In short

A Slowloris attack can overwhelm web servers by sending many incomplete requests very slowly, exhausting server resources and making the service unavailable to legitimate users.

Technical detail

The vulnerability allows a remote attacker to execute a Slowloris-based denial of service attack by maintaining multiple slow, incomplete HTTP connections to the affected BLU-IC2 and BLU-IC4 devices (versions ≤1.19.5), exhausting connection pools and server threads without requiring authentication or special privileges.

Summary generated and translated by AI from the official description.
Denial of Service Due to SlowLoris.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Azure Access Technology · BLU-IC2Azure Access Technology · BLU-IC4
Related CVEs — Azure Access Technology BLU-IC2

In the same product, most dangerous first.

CVE-2025-12275CRITICALMail Configuration File Manipulation + Command ExecutionEPSS 0.5%CVE-2025-12422CRITICALVulnerable Upgrade Feature (Arbitrary File Write)EPSS 0.5%CVE-2025-12599CRITICALMultiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)EPSS 0.4%CVE-2025-12104CRITICALIncorrect Content-Type HeaderEPSS 0.4%CVE-2025-12600CRITICALWeb UI MalfunctionEPSS 0.4%CVE-2025-12554MEDIUMMissing Security HeadersEPSS 0.4%