External risk intelligence

BLU-IC2 and BLU-IC4 Weak Default Credentials Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12218

The affected products are identified as BLU-IC2 and BLU-IC4, which are physical access control panels. These devices are commonly deployed as edge-connected appliances that manage entry points, making their management interfaces or networked services frequently accessible via local or wide area networks, and they are often configured with network connectivity for remote administration.

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in BLU-IC devices, stemming from weak default credentials. This type of issue can allow unauthorized access to systems if not properly secured, potentially impacting the confidentiality, integrity, and availability of connected resources. Given the nature of the affected technology, confirming its presence and the specific configurations in use is the primary concern.- Weak credentials allow unauthorized access.

Affects access control systems.
Confirm device relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by targeting network-accessible management interfaces of BLU-IC2 or BLU-IC4 devices. Without needing any privileges or user interaction, an attacker could leverage weak default credentials to gain unauthorized access. Successful exploitation could lead to a complete compromise of the device's confidentiality, integrity, and availability.

No special access required.
Weak default credentials.
Full device compromise.

Live Threat

Current exploitation, exposure, and threat context

The affected devices, BLU-IC2 and BLU-IC4, could be at risk when configured with weak default credentials. This may allow unauthorized individuals to access system data and potentially alter service behavior.

System data and access control could be compromised.
Weak default credentials may be exploited.
Unauthorized access to physical locations.

Operational Fix

Recommended remediation, mitigation, and detection steps

The weak default credentials in BLU-IC2 and BLU-IC4 affect the accessibility and integrity of physical access control systems. Technical leaders and security teams should prioritize identifying all instances of the affected technology, confirming their network reachability and criticality to business operations, and then locating the accountable system owner to initiate a risk-based remediation plan.

Identify affected asset owners.
Verify network exposure and impact.
Plan coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the BLU-IC2 and BLU-IC4 technology?

These are physical access control panels manufactured by Azure Access. They function as edge-connected appliances that manage electronic entry points, such as doors or gates, within a building. Security teams use them to regulate and log traffic across facility perimeters.

What does CWE-1392 mean for CVE-2025-12218?

This CVE involves Weak Default Credentials (CWE-1392). It means the devices ship with pre-set usernames or passwords that are easily guessed or publicly known. Because these credentials grant entry to the system, an attacker can bypass authentication entirely to take full control of the panel's functions.

How can an attacker trigger this vulnerability?

An attacker targets the management interface of a vulnerable device over the network. No prior system privileges, specific user actions, or complex conditions are required to initiate the attack. If the default password has not been changed, the system is susceptible simply by being reachable.

Is my device relevant according to Halo Surface Signal?

Halo Surface Signal identifies these panels as likely candidates for concern because they are designed to be edge-connected. If your BLU-IC2 or BLU-IC4 unit is accessible via a local or wide area network for remote administration, it faces a higher probability of being discovered and targeted by external actors.

What should I do if I run these access control panels?

First, conduct an inventory to identify all BLU-IC2 and BLU-IC4 units in your environment. Prioritize those with network connectivity, verify if they still use original factory credentials, and assign a system owner to coordinate a plan for updating those credentials or applying the latest firmware.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.