External risk intelligence

BLU-IC Incorrect Content-Type Allows HTML JavaScript Injection

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-11925

The vulnerability affects BLU-IC series access control hardware, which are commonly deployed as network-connected appliance portals or gateways. As these devices are designed to manage physical access and are frequently reachable via management APIs over a network, they are commonly exposed as internet-facing or edge services in typical real-world deployments.

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in specific API responses that could allow the injection of malicious code, potentially impacting the integrity and security of systems that rely on these APIs. The primary concern is confirming the relevance and exposure of affected systems within our environment.

Code injection risk in API replies.
Important for potential system integrity impact.
Confirm relevance and exposure of affected systems.

Attack Path

How an attacker could exploit the issue

An attacker can potentially inject HTML or JavaScript into API replies by exploiting an incorrect `text/html` Content-Type header. This misconfiguration allows for the injection of malicious code, which could then be rendered by a user's browser.

Accessible via network, no privileges needed.
Incorrect Content-Type header in API responses.
Allows HTML/JavaScript injection into replies.

Live Threat

Current exploitation, exposure, and threat context

An incorrect `Content-Type` header in certain API responses could allow for the injection of HTML or JavaScript. This may occur when the API incorrectly sends `text/html` instead of `application/json`, potentially impacting the behavior of the affected systems.

System data and service behavior.
HTML/JavaScript injection via API responses.
Potential for altered service functionality.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects BLU-IC access control devices, which are typically managed by infrastructure or platform teams. The initial step is to identify all instances of the affected technology, confirm their reachability and business criticality, and then assign ownership for remediation planning.

Identify device inventory and owner.
Verify network exposure and criticality.
Plan and execute vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the BLU-IC2 and BLU-IC4 hardware?

The BLU-IC series consists of network-connected access control hardware. Organizations use these devices as portals or gateways to manage and secure physical entry points. They provide management interfaces that allow administrators to interact with the system via APIs.

How does CVE-2025-11925 work?

This vulnerability involves an improper header configuration, specifically categorized as CWE-754. Because the API mistakenly labels its responses as HTML rather than JSON, a browser might interpret the returned data as a webpage. This confusion allows an attacker to inject and execute malicious HTML or JavaScript code within the context of the API response.

When can an attacker trigger this vulnerability?

An attacker can trigger this issue by interacting with the affected API over the network. No prior authentication or specific user privileges are required to initiate the request. The flaw is not triggered when the API correctly identifies the content as standard data or when client-side applications do not render the API output as HTML.

Is my device at risk if it is not on the internet?

Halo Surface Signal indicates that while these devices are frequently deployed as internet-facing edge services, the risk persists for any system reachable over a network. If your BLU-IC hardware is accessible to users or systems on your internal network, it remains relevant to this vulnerability, even if it is not directly exposed to the public internet.

What should I do first to address this?

Your first step is to create a comprehensive inventory of all BLU-IC2 and BLU-IC4 devices in your environment. Once identified, evaluate the network accessibility and business criticality of each unit. Finally, consult the official vendor security advisories to determine the available update paths or configuration changes to mitigate the risk.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.