CVE-2025-12552
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
BLU-IC2 and BLU-IC4 devices enforce an insufficient password policy. The issue affects versions through 1.19.5.
Risk Assessment
A weak password policy allows easily guessable passwords, increasing the risk of unauthorized access and potential account or device compromise.
Recommendation
Update BLU-IC2 and BLU-IC4 firmware to a version later than 1.19.5 and enforce a strong password policy (length, complexity, rotation).
Other vulnerabilities in BLU-IC
See all- CVE-2025-12477Critical
BLU-IC2 and BLU-IC4 devices disclose server version information. The issue affects versions through 1.19.5.
- CVE-2025-12476Critical
BLU-IC2 and BLU-IC4 devices contain a resource lacking authentication (AuthN). The issue affects versions through 1.19.5.
- CVE-2025-12424Critical
BLU-IC2 and BLU-IC4 devices allow privilege escalation through a SUID-bit binary. The issue affects versions through 1.19.5.
- CVE-2025-12364Critical
BLU-IC2 and BLU-IC4 devices enforce a weak password policy. The issue affects versions through 1.19.5.
- CVE-2025-12285Critical
BLU-IC2 and BLU-IC4 devices do not enforce an initial password change at first login. The issue affects versions through 1.19.5.
Original NVD description (English source)
Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS