CVE-2025-12364
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
BLU-IC2 and BLU-IC4 devices enforce a weak password policy. The issue affects versions through 1.19.5.
Risk Assessment
A weak password policy encourages guessable passwords, potentially leading to unauthorized access and increased risk of device compromise.
Recommendation
Update BLU-IC2 and BLU-IC4 firmware to a version later than 1.19.5 and enforce strong passwords with regular rotation.
Other vulnerabilities in BLU-IC
See all- CVE-2025-12552Critical
BLU-IC2 and BLU-IC4 devices enforce an insufficient password policy. The issue affects versions through 1.19.5.
- CVE-2025-12477Critical
BLU-IC2 and BLU-IC4 devices disclose server version information. The issue affects versions through 1.19.5.
- CVE-2025-12476Critical
BLU-IC2 and BLU-IC4 devices contain a resource lacking authentication (AuthN). The issue affects versions through 1.19.5.
- CVE-2025-12424Critical
BLU-IC2 and BLU-IC4 devices allow privilege escalation through a SUID-bit binary. The issue affects versions through 1.19.5.
- CVE-2025-12285Critical
BLU-IC2 and BLU-IC4 devices do not enforce an initial password change at first login. The issue affects versions through 1.19.5.
Original NVD description (English source)
Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS