External risk intelligence

BLU-IC2 and BLU-IC4 application manifest sanitation flaw allows stored XSS.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12001

The affected products, BLU-IC2 and BLU-IC4, are physical access control controllers (gateways) typically deployed to manage building entry points. Such hardware appliances often feature web-based management interfaces or network-facing APIs that are commonly reachable within an organization's network or, in some deployments, exposed to facilitate remote administration.

Cross-site Scripting

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in BLU-IC2 and BLU-IC4 devices that could allow for cross-site scripting attacks if malicious input is not properly handled. This could potentially impact the management interface of these systems, which are used for access control.

Input sanitization failure allows harmful code injection.
Access control systems could be compromised.
Confirm relevance and exposure to these devices.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by sending specially crafted input to the affected product, which lacks proper validation of application manifest data. This could allow an attacker to inject malicious scripts that execute within the user's browser session. The outcome, when supported, could involve significant compromise of system integrity and confidentiality.

No special access or authentication required.
Vulnerable component accepts unverified input.
Potential for stored cross-site scripting.

Live Threat

Current exploitation, exposure, and threat context

A lack of proper sanitation in application manifests could allow for stored cross-site scripting (XSS) attacks. This could affect sensitive information displayed through the system's user interface when specific, supported conditions are met.

System data displayed via interface.
Malicious scripts injected into manifests.
Unauthorized information disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The potential for stored cross-site scripting necessitates immediate attention from teams responsible for application security and infrastructure. The first practical step involves identifying all instances of the affected BLU-IC products, assessing their network exposure and criticality, and then confirming the accountable owner for remediation or mitigation.

Own by: Application and Infrastructure teams.
Verify first: Identify and locate all affected devices.
Action: Plan risk-based remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the BLU-IC2 and BLU-IC4 hardware used for?

These products are physical access control controllers. They function as gateways designed to manage and secure building entry points, often incorporating web-based interfaces or network APIs for administrative configuration and monitoring.

What does this CVE mean by stored XSS?

This vulnerability, classified as CWE-79, occurs because the software fails to sanitize application manifest data. By injecting malicious scripts into these manifests, an attacker can ensure the code executes automatically whenever a user views the compromised data within the management interface.

How does an attacker trigger this vulnerability?

The trigger involves submitting specially crafted input to the system that the device fails to validate. Importantly, an attacker does not need prior authentication or elevated system access to submit this input, as the system lacks proper checks on incoming manifest data.

Do I need to worry if my BLU-IC devices are internal?

Halo Surface Signal indicates these controllers are often deployed to manage sensitive entry points. While internet-facing units are at the highest risk, internal devices remain relevant because the vulnerability's impact on system integrity and data confidentiality is significant if a network-based attacker reaches the management interface.

What is the first step to address CVE-2025-12001?

Begin by inventorying your environment to locate all active BLU-IC2 and BLU-IC4 units. Once identified, evaluate their network placement and prioritize them based on their criticality to your security infrastructure before coordinating with the accountable teams to plan your mitigation path.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.