External risk intelligence

Outdated UI Dependencies in BLU-IC2 and BLU-IC4 Could Lead to Exploitation.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12104

The affected products are physical access control controllers (BLU-IC2 and BLU-IC4) that typically function as networked appliances. These devices often feature web-based management interfaces or API endpoints that are commonly deployed in network-accessible configurations to facilitate centralized management, making them likely to be reachable from an organizational network or the public internet.

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Outdated user interface dependencies in BLU-IC2 and BLU-IC4 devices present a critical risk, potentially allowing for widespread compromise without requiring user interaction or special privileges. This vulnerability stems from the use of vulnerable third-party components within the product's interface.

Unpatched UI software can be exploited remotely.
Critical systems may be at risk due to outdated software.
Confirm relevance and exposure for critical control systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit outdated user interface dependencies in networked access control devices to gain unauthorized access and control. These devices, often accessible via a network, present a potential pathway for attackers to interact with vulnerable components. Successful exploitation could lead to a compromise of the system's integrity and availability.

Attacker needs network access.
Outdated UI dependencies trigger vulnerability.
Leads to full system compromise.

Live Threat

Current exploitation, exposure, and threat context

The vulnerability in outdated UI dependencies could allow attackers to gain unauthorized access and control over critical system functions. This could impact the confidentiality, integrity, and availability of the system when these devices are network-accessible.

System data and control
Network access
Unauthorized system control

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership for this vulnerability likely falls to teams managing the application or infrastructure where the affected UI dependencies reside, potentially involving platform or network/security teams. The first practical step is to identify all instances of the affected technology, confirm their network reachability and business criticality, and then identify the accountable owner to plan remediation based on risk.

Identify accountable application or platform owners.
Verify affected technology reachability and criticality.
Plan targeted remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is BLU-IC2 and BLU-IC4?

These are physical access control controllers manufactured by Azure Access. They serve as hardware appliances that manage building security, electronic locks, and entry points. By acting as networked controllers, they allow administrators to remotely oversee and enforce facility access policies through integrated management interfaces.

What does CWE-1104 mean for this CVE?

CVE-2025-12104 involves CWE-1104, which refers to the use of outdated or unmaintained third-party software dependencies. In the context of these controllers, the software powering the user interface relies on external code libraries that are no longer supported, creating gaps that attackers can potentially use to bypass security protections.

How is this vulnerability triggered?

An attacker triggers this vulnerability by sending crafted network traffic to the device's management interface. The flaw resides within the UI dependencies, so it does not require an authenticated session or physical interaction with the controller. Note that simply having the device powered on is not enough; the attacker must have network reachability to the specific interface using these outdated components.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal identifies BLU-IC2 and BLU-IC4 as likely at risk because these controllers are typically deployed as networked appliances. If your devices are configured with management interfaces accessible from your broader organizational network or the public internet, they are considered reachable and therefore susceptible to remote exploitation attempts.

What should I do first to address this?

Begin by creating an inventory of all deployed BLU-IC2 and BLU-IC4 controllers in your environment. Determine which units are connected to your network and assess their accessibility. Once identified, locate the internal team responsible for managing these physical security systems to prioritize applying the latest firmware updates.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.