External risk intelligence

Azure Access BLU-IC Resource Flooding Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-11832

The affected products are Azure Access Technology BLU-IC2 and BLU-IC4, which are physical access control panels. These devices are commonly deployed as network-connected appliances to manage secure facility access, often requiring remote reachability for administration or integration with building management systems, placing them at the network edge.

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves resource allocation issues in Azure Access Technology BLU-IC2 and BLU-IC4. At its core, it means these systems could be overwhelmed by excessive requests, potentially disrupting access control functions. The main concern is confirming if our environment uses these specific technologies and if they are exposed in a way that could be targeted.

Systems could be overloaded with requests.
Affects critical physical access control.
Confirm relevance and exposure to our systems.

Attack Path

How an attacker could exploit the issue

Attackers can reach unauthenticated Azure Access Technology devices over the network and trigger a vulnerability that allows them to exhaust system resources. This can lead to a denial-of-service condition, preventing legitimate access control operations.

Network access required.
Vulnerability triggered remotely.
Flooding causes denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to flood the system by allocating unlimited resources when the affected Azure Access Technology devices are accessible over a network. This could disrupt service availability and potentially impact the device's ability to manage access controls.

Network-connected access control systems could be flooded.
Unlimited resource allocation could be triggered remotely.
Service disruption and denial of access could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Azure Access Technology BLU-IC devices likely requires a coordinated response involving infrastructure, platform, and network security teams. The first practical step is to identify all deployments of the affected BLU-IC2 and BLU-IC4 technologies, confirm their network exposure and business criticality, and identify the accountable asset owners. Remediation planning should then be prioritized based on this risk assessment.

Infrastructure and security teams own remediation.
Verify device reachability and criticality.
Plan vendor coordination and phased updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Azure Access Technology BLU-IC2 and BLU-IC4?

These devices are specialized physical access control panels used to manage entry and exit for secure facilities. They act as network-connected appliances that interface with door readers and locks, functioning as critical infrastructure to maintain building security and integrate with broader facility management systems.

What does CWE-770 mean for CVE-2025-11832?

CWE-770 refers to Allocation of Resources Without Limits or Throttling. In the context of CVE-2025-11832, it means the software does not restrict how many requests or data units a user can trigger. An attacker can exploit this by flooding the device with excessive requests, consuming all available system resources and forcing the panel to stop functioning.

How is this resource flooding vulnerability triggered?

The issue is triggered when an attacker sends a high volume of requests to the device over the network. Crucially, the vulnerability does not require authentication; an attacker can initiate this flooding remotely without prior system access. Normal operations that stay within the intended capacity of the system will not trigger this condition.

Is my organization at risk from this vulnerability?

According to Halo Surface Signal, these access control panels are frequently deployed at the network edge to allow for remote administration or building management integration. If your BLU-IC2 or BLU-IC4 units are accessible from the broader network, they are considered external and have a higher likelihood of being reachable by unauthorized parties.

What should I do to secure my affected BLU-IC devices?

Begin by creating a complete inventory of all BLU-IC2 and BLU-IC4 units within your environment to understand where they are installed. Work with your network security team to verify if these devices are exposed to the public internet or untrusted network segments. Once mapped, identify the asset owners and prepare for vendor-supplied updates to address the resource management flaw.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.