CVE-2025-12603
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
/etc/timezone can be written arbitrarily, allowing uncontrolled modification of the timezone configuration. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
Risk Assessment
Arbitrary write access to /etc/timezone can be used to tamper with system configuration and affect logs, schedules, and time-based security mechanisms. This may facilitate further attacks.
Recommendation
Update BLU-IC2 and BLU-IC4 to a version later than 1.19.5 and restrict write permissions on system configuration files.
Other vulnerabilities in BLU-IC2 / BLU-IC4
See all- CVE-2025-12602Critical
/etc/avahi/services/z9.service can be written arbitrarily, allowing uncontrolled modification of the Avahi service configuration. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12600Critical
Web UI Malfunction when setting unexpected locale via API. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CVE-2025-12599Critical
Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000). This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CVE-2025-12554Critical
Missing Security Headers. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CVE-2025-12422Critical
A vulnerable upgrade feature in BLU-IC2 and BLU-IC4 devices (through version 1.19.5) allows arbitrary file write, potentially leading to obtaining super user permissions on the board.
- CVE-2025-12275Critical
A vulnerability in BLU-IC2 and BLU-IC4 devices (through version 1.19.5) allows mail configuration file manipulation and command execution. This can lead to full device compromise.
- CVE-2025-12218Critical
The devices use weak default credentials that can be easily guessed or cracked. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12176Critical
Undocumented administrative accounts are being created to facilitate access for applications running on the device. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12104Critical
Outdated and Vulnerable UI Dependencies might potentially lead to exploitation. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Original NVD description (English source)
/etc/timezone can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS