CVE-2025-12176
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Undocumented administrative accounts are being created to facilitate access for applications running on the device. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
Risk Assessment
Undocumented administrative accounts can enable unauthorized system access and bypass standard access controls. This poses a serious risk of device takeover.
Recommendation
Update BLU-IC2 and BLU-IC4 to a version later than 1.19.5 and audit the system for unexpected administrative accounts, removing them.
Other vulnerabilities in BLU-IC2 / BLU-IC4
See all- CVE-2025-12603Critical
/etc/timezone can be written arbitrarily, allowing uncontrolled modification of the timezone configuration. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12602Critical
/etc/avahi/services/z9.service can be written arbitrarily, allowing uncontrolled modification of the Avahi service configuration. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12600Critical
Web UI Malfunction when setting unexpected locale via API. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CVE-2025-12599Critical
Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000). This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CVE-2025-12554Critical
Missing Security Headers. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CVE-2025-12422Critical
A vulnerable upgrade feature in BLU-IC2 and BLU-IC4 devices (through version 1.19.5) allows arbitrary file write, potentially leading to obtaining super user permissions on the board.
- CVE-2025-12275Critical
A vulnerability in BLU-IC2 and BLU-IC4 devices (through version 1.19.5) allows mail configuration file manipulation and command execution. This can lead to full device compromise.
- CVE-2025-12218Critical
The devices use weak default credentials that can be easily guessed or cracked. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12104Critical
Outdated and Vulnerable UI Dependencies might potentially lead to exploitation. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Original NVD description (English source)
Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS