CVE-2025-12363
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Email Password Disclosure. This issue affects BLU-IC2 through 1.19.5 and BLU-IC4 through 1.19.5.
Risk Assessment
Disclosure of an email password may allow an attacker to take over the email account and access confidential correspondence. This can lead to further phishing attacks or data leakage.
Recommendation
Update BLU-IC2 and BLU-IC4 to a version later than 1.19.5. Change the disclosed email passwords and enable multi-factor authentication.
Other vulnerabilities in BLU-IC2/BLU-IC4
See all- CVE-2025-12603Critical
/etc/timezone can be written arbitrarily, allowing uncontrolled modification of the timezone configuration. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12602Critical
/etc/avahi/services/z9.service can be written arbitrarily, allowing uncontrolled modification of the Avahi service configuration. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12600Critical
Web UI Malfunction when setting unexpected locale via API. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CVE-2025-12599Critical
Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000). This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CVE-2025-12554Critical
Missing Security Headers. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CVE-2025-12422Critical
A vulnerable upgrade feature in BLU-IC2 and BLU-IC4 devices (through version 1.19.5) allows arbitrary file write, potentially leading to obtaining super user permissions on the board.
- CVE-2025-12275Critical
A vulnerability in BLU-IC2 and BLU-IC4 devices (through version 1.19.5) allows mail configuration file manipulation and command execution. This can lead to full device compromise.
- CVE-2025-12218Critical
The devices use weak default credentials that can be easily guessed or cracked. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12176Critical
Undocumented administrative accounts are being created to facilitate access for applications running on the device. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12104Critical
Outdated and Vulnerable UI Dependencies might potentially lead to exploitation. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Original NVD description (English source)
Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS