CVE-2025-12479
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Systemic lack of Cross-Site Request Forgery (CSRF) token implementation. This issue affects BLU-IC2 through 1.19.5 and BLU-IC4 through 1.19.5.
Risk Assessment
Lack of CSRF protection may allow an attacker to force unwanted actions on behalf of a logged-in user, e.g. via a malicious website.
Recommendation
Update BLU-IC2/BLU-IC4 to a version newer than 1.19.5 if available, or implement custom CSRF protection mechanisms.
Other vulnerabilities in BLU-IC2/BLU-IC4
See all- CVE-2025-12603Critical
/etc/timezone can be written arbitrarily, allowing uncontrolled modification of the timezone configuration. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12602Critical
/etc/avahi/services/z9.service can be written arbitrarily, allowing uncontrolled modification of the Avahi service configuration. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12600Critical
Web UI Malfunction when setting unexpected locale via API. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CVE-2025-12599Critical
Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000). This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CVE-2025-12554Critical
Missing Security Headers. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CVE-2025-12422Critical
A vulnerable upgrade feature in BLU-IC2 and BLU-IC4 devices (through version 1.19.5) allows arbitrary file write, potentially leading to obtaining super user permissions on the board.
- CVE-2025-12275Critical
A vulnerability in BLU-IC2 and BLU-IC4 devices (through version 1.19.5) allows mail configuration file manipulation and command execution. This can lead to full device compromise.
- CVE-2025-12218Critical
The devices use weak default credentials that can be easily guessed or cracked. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12176Critical
Undocumented administrative accounts are being created to facilitate access for applications running on the device. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12104Critical
Outdated and Vulnerable UI Dependencies might potentially lead to exploitation. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Original NVD description (English source)
Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
Vulnerability data from NVD (NIST) · CISA KEV · EPSS