CVE-2025-12285
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
BLU-IC2 and BLU-IC4 devices do not enforce an initial password change at first login. The issue affects versions through 1.19.5.
Risk Assessment
Failure to force a default password change leaves the device with predictable credentials, which attackers may use for unauthorized access.
Recommendation
Update BLU-IC2 and BLU-IC4 firmware to a version later than 1.19.5 and enforce a password change at first login.
Other vulnerabilities in BLU-IC
See all- CVE-2025-12552Critical
BLU-IC2 and BLU-IC4 devices enforce an insufficient password policy. The issue affects versions through 1.19.5.
- CVE-2025-12477Critical
BLU-IC2 and BLU-IC4 devices disclose server version information. The issue affects versions through 1.19.5.
- CVE-2025-12476Critical
BLU-IC2 and BLU-IC4 devices contain a resource lacking authentication (AuthN). The issue affects versions through 1.19.5.
- CVE-2025-12424Critical
BLU-IC2 and BLU-IC4 devices allow privilege escalation through a SUID-bit binary. The issue affects versions through 1.19.5.
- CVE-2025-12364Critical
BLU-IC2 and BLU-IC4 devices enforce a weak password policy. The issue affects versions through 1.19.5.
Original NVD description (English source)
Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS