CVE-2025-12217

CriticalCVSS 9.1

Published: 25/10/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

21th percentile - higher than 21% of all known CVEs

Summary

BLU-IC2 and BLU-IC4 devices through version 1.19.5 use the default SNMP community string 'public'. This allows unauthorized access to management information via SNMP.

Risk Assessment

An attacker could read or modify device configuration via SNMP, potentially leading to data disclosure or configuration changes.

Recommendation

Change the default SNMP community string to a unique and strong one, restrict SNMP access, and update the firmware to the latest version.

Other vulnerabilities in BLU-IC2/IC4

See all

CVE-2025-12553Critical
Email Server Certificate Verification Disabled. This issue affects BLU-IC2 through 1.19.5 and BLU-IC4 through 1.19.5.
CVE-2025-12478Critical
Non-Compliant TLS Configuration. This issue affects BLU-IC2 through 1.19.5 and BLU-IC4 through 1.19.5.

Original NVD description (English source)

SNMP Default Community String (public).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS