CVE-2025-12478
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Non-Compliant TLS Configuration. This issue affects BLU-IC2 through 1.19.5 and BLU-IC4 through 1.19.5.
Risk Assessment
An attacker could exploit weak TLS configuration to intercept or modify transmitted data.
Recommendation
Update the device firmware to a version that fixes the TLS configuration, or manually correct the TLS configuration according to security best practices.
Other vulnerabilities in BLU-IC2/IC4
See all- CVE-2025-12553Critical
Email Server Certificate Verification Disabled. This issue affects BLU-IC2 through 1.19.5 and BLU-IC4 through 1.19.5.
- CVE-2025-12217Critical
BLU-IC2 and BLU-IC4 devices through version 1.19.5 use the default SNMP community string 'public'. This allows unauthorized access to management information via SNMP.
Original NVD description (English source)
Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
Vulnerability data from NVD (NIST) · CISA KEV · EPSS