CVE-2025-12424
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
BLU-IC2 and BLU-IC4 devices allow privilege escalation through a SUID-bit binary. The issue affects versions through 1.19.5.
Risk Assessment
A local attacker could leverage the SUID binary to escalate privileges to root, enabling full control of the device.
Recommendation
Update BLU-IC2 and BLU-IC4 firmware to a version later than 1.19.5 and remove or restrict unnecessary SUID bits on binaries.
Other vulnerabilities in BLU-IC
See all- CVE-2025-12552Critical
BLU-IC2 and BLU-IC4 devices enforce an insufficient password policy. The issue affects versions through 1.19.5.
- CVE-2025-12477Critical
BLU-IC2 and BLU-IC4 devices disclose server version information. The issue affects versions through 1.19.5.
- CVE-2025-12476Critical
BLU-IC2 and BLU-IC4 devices contain a resource lacking authentication (AuthN). The issue affects versions through 1.19.5.
- CVE-2025-12364Critical
BLU-IC2 and BLU-IC4 devices enforce a weak password policy. The issue affects versions through 1.19.5.
- CVE-2025-12285Critical
BLU-IC2 and BLU-IC4 devices do not enforce an initial password change at first login. The issue affects versions through 1.19.5.
Original NVD description (English source)
Privilege Escalation through SUID-bit Binary.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
Vulnerability data from NVD (NIST) · CISA KEV · EPSS