External risk intelligence

BLU-IC2 and BLU-IC4 Firmware Installation and Uninstallation Flaw

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12216

The affected products are physical access control panels (BLU-IC2 and BLU-IC4). While these devices are typically deployed within private, protected networks to manage building security, they are network-connected components. Public internet exposure is not a standard configuration, but their role as networked controllers makes reachability from a broader network environment possible in some deployments.

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a critical issue in access control systems that could allow malicious applications to be installed, with the potential for them to be uninstalled, impacting system availability. The primary concern is confirming the relevance and exposure of these systems within our environment.

Malicious apps can be installed, but not removed.
Access control systems may become unavailable.
Confirm relevance and exposure of affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could leverage a specially crafted application to target network-connected access control panels. Once installed, this malicious application can resist removal, potentially disrupting the device's normal operation and causing unavailability.

A malicious app can be installed.
The app cannot be uninstalled.
Leads to device unavailability.

Live Threat

Current exploitation, exposure, and threat context

A malicious or malformed application could be installed on affected systems, leading to potential unavailability of the service. This could occur when an attacker can install such applications without proper vetting or uninstallation mechanisms.

System service unavailability.
Malformed apps can be installed.
Service may become unavailable.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security teams and infrastructure owners are likely responsible for addressing this vulnerability, as it affects network-connected physical access control devices. The first practical step is to identify all deployed BLU-IC2 and BLU-IC4 devices, determine their network reachability and business criticality, and then coordinate with the accountable owner for remediation planning.

Identify and assess affected devices.
Verify network reachability and criticality.
Plan remediation with owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is BLU-IC2 and BLU-IC4?

These are physical access control panels manufactured by Azure Access. They function as networked controllers, typically installed in buildings to manage electronic locks, badge readers, and facility entry points. By regulating physical movement, these firmware-based devices serve as essential infrastructure for securing office environments and controlled areas.

What does CVE-2025-12216 mean?

This vulnerability, classified as CWE-1301 (Insufficient Control of Network Message Volume or similar resource constraint), allows a malicious or malformed software application to be installed on the hardware. Once the application is placed on the device, it cannot be removed. This creates a persistent state that can lead to complete service unavailability, effectively bricking or disabling the controller's ability to manage access.

How does an attacker trigger this vulnerability?

The issue is triggered by the successful installation of a specially crafted, malicious application package. The vulnerability is not triggered by legitimate, vetted software updates. It requires the attacker to have the capability to interact with the device's installation process; simply connecting to the device's network without initiating an application installation does not activate this specific bug.

Is my organization at risk for CVE-2025-12216?

According to Halo Surface Signal, these controllers are generally deployed within private, protected networks, which limits their visibility to the public internet. However, because they are network-connected devices, they are reachable if your internal network architecture allows broad access to these management segments. Your level of risk depends on how isolated these controllers are from the wider corporate network.

How do I start addressing this issue?

The initial step is to perform an inventory of all deployed BLU-IC2 and BLU-IC4 units across your facilities. Confirm which units are running firmware versions prior to 1.20, which is the baseline affected range. Once identified, evaluate their network placement to determine if they are exposed to untrusted segments and coordinate with your physical security or facility management teams to plan for the necessary firmware updates.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.