CVE-2025-12477
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
BLU-IC2 and BLU-IC4 devices disclose server version information. The issue affects versions through 1.19.5.
Risk Assessment
Server version disclosure helps attackers perform reconnaissance and select exploits matching known flaws, increasing the effectiveness of targeted attacks.
Recommendation
Update BLU-IC2 and BLU-IC4 firmware to a version later than 1.19.5 and disable or restrict headers that reveal the server version.
Other vulnerabilities in BLU-IC
See all- CVE-2025-12552Critical
BLU-IC2 and BLU-IC4 devices enforce an insufficient password policy. The issue affects versions through 1.19.5.
- CVE-2025-12476Critical
BLU-IC2 and BLU-IC4 devices contain a resource lacking authentication (AuthN). The issue affects versions through 1.19.5.
- CVE-2025-12424Critical
BLU-IC2 and BLU-IC4 devices allow privilege escalation through a SUID-bit binary. The issue affects versions through 1.19.5.
- CVE-2025-12364Critical
BLU-IC2 and BLU-IC4 devices enforce a weak password policy. The issue affects versions through 1.19.5.
- CVE-2025-12285Critical
BLU-IC2 and BLU-IC4 devices do not enforce an initial password change at first login. The issue affects versions through 1.19.5.
Original NVD description (English source)
Server Version Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
Vulnerability data from NVD (NIST) · CISA KEV · EPSS