← Vulnerability feed

Vulnerability record · CVE-2025-12176 · published 24 October 2025

CVE-2025-12176: Azure-access blu-ic2 firmware vulnerability

Azure Access · Blu Ic2 Firmware

Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

10.0 CVSS 4.0 Critical EPSS 0.34% · top 74.9% CWE-1242 · CWE-1242
10.0CVSS 4.0 base score
0.34%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://azure-access.com/security-advisories Vendor Advisory

Track CVE-2025-12176 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2025-12599Azure-access blu-ic2 firmware vulnerabilityMultiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.EPSS 0.40%10.0CVE-2025-12600Azure-access blu-ic2 firmware vulnerabilityWeb UI Malfunction when setting unexpected locale via API.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.EPSS 0.35%10.0CVE-2025-12601Azure-access blu-ic2 firmware vulnerabilityDenial of Service Due to SlowLoris.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.EPSS 0.31%10.0CVE-2025-12553Azure-access blu-ic2 firmware vulnerabilityEmail Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.EPSS 0.21%10.0CVE-2025-12516Azure-access blu-ic2 firmware vulnerabilityLack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .EPSS 0.35%10.0CVE-2025-12515Azure-access blu-ic4 firmware vulnerabilitySystemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .EPSS 0.35%10.0CVE-2025-12479Azure-access blu-ic2 firmware cross-site request forgery vulnerabilitySystemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .EPSS 0.16%10.0CVE-2025-12476Azure-access blu-ic2 firmware missing authentication for critical function vulnerabilityResource Lacking AuthN.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .EPSS 0.32%

Source: NIST National Vulnerability Database (record CVE-2025-12176), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.