CVE-2025-12476
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
BLU-IC2 and BLU-IC4 devices contain a resource lacking authentication (AuthN). The issue affects versions through 1.19.5.
Risk Assessment
An unauthenticated resource may be abused by an unauthorized user to obtain information or perform operations, expanding the device attack surface.
Recommendation
Update BLU-IC2 and BLU-IC4 firmware to a version later than 1.19.5 and protect the resource with required authentication.
Other vulnerabilities in BLU-IC
See all- CVE-2025-12552Critical
BLU-IC2 and BLU-IC4 devices enforce an insufficient password policy. The issue affects versions through 1.19.5.
- CVE-2025-12477Critical
BLU-IC2 and BLU-IC4 devices disclose server version information. The issue affects versions through 1.19.5.
- CVE-2025-12424Critical
BLU-IC2 and BLU-IC4 devices allow privilege escalation through a SUID-bit binary. The issue affects versions through 1.19.5.
- CVE-2025-12364Critical
BLU-IC2 and BLU-IC4 devices enforce a weak password policy. The issue affects versions through 1.19.5.
- CVE-2025-12285Critical
BLU-IC2 and BLU-IC4 devices do not enforce an initial password change at first login. The issue affects versions through 1.19.5.
Original NVD description (English source)
Resource Lacking AuthN.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
Vulnerability data from NVD (NIST) · CISA KEV · EPSS