External risk intelligence

BLU-IC Upgrade Feature Arbitrary File Write Leading to Super User Permissions.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12422

The affected products are physical access control panels (BLU-IC series) used to manage electronic door locks and facility security. These devices are frequently deployed as network-connected appliances and management gateways that maintain communication with a central server or management software, making them commonly reachable within organizational networks and potentially exposed in edge-service deployments.

Path Traversal

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in certain firmware versions of BLU-IC devices, which are used for access control. This flaw could allow an unauthorized party to gain complete control over the affected systems, potentially leading to unauthorized access and elevated privileges. The main concern is to confirm if these specific devices are in use and determine the extent of exposure.

An upgrade feature flaw can grant super user access.
This could allow unauthorized control of physical access.
Confirm device relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by leveraging the network to write arbitrary files to the system. This could occur if an attacker finds a way to interact with the upgrade feature, which is exposed to the network without requiring any privileges or user interaction. Successfully triggering this vulnerability can lead to an attacker gaining super user permissions on the device.

Network access required.
Vulnerable upgrade feature.
Risk of super user permissions.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to write arbitrary files to the system. When supported by the advisory, this could lead to an attacker obtaining super user permissions on the affected devices, potentially impacting the confidentiality, integrity, and availability of the system.

System configuration data at risk.
Arbitrary file write to system.
Loss of system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Critical vulnerability impacting the BLU-IC series firmware requires immediate attention from teams responsible for operational technology (OT) and physical security infrastructure. The first practical step is to identify all instances of the affected technology within your environment, assess their network exposure and business criticality, and confirm the accountable system owner before planning remediation.

OT and security infrastructure teams own the issue.
Verify network reachability and criticality first.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the BLU-IC series hardware?

The BLU-IC2 and BLU-IC4 are physical access control panels manufactured by Azure Access. These devices act as networked management gateways that connect to central security software to manage electronic door locks and facility entry points. They are typically deployed as dedicated appliances to maintain secure site access.

How does CVE-2025-12422 work?

This vulnerability is classified as an improper limitation of a pathname to a restricted directory, or CWE-22. It affects a specific firmware upgrade feature, allowing an unauthorized user to write arbitrary files to the device's system storage. By placing these files in critical locations, an attacker can overwrite system configurations to gain super user permissions, essentially taking full control of the device.

Do I need to authenticate to trigger this flaw?

No, authentication is not required to trigger this vulnerability. The upgrade feature is reachable over the network and does not verify the identity of the person or system interacting with it. Note that the flaw is specific to the upgrade mechanism; standard, non-upgrade communications with the panel do not initiate the file write process.

Why is this a risk for my network?

According to Halo Surface Signal, BLU-IC devices are often managed via network-connected appliances. If these panels are reachable over an organizational network or exposed to the internet at the network edge, an attacker could potentially gain full control of your facility's physical security infrastructure remotely without needing local access.

How do I start addressing this CVE?

Begin by auditing your environment to locate all BLU-IC2 and BLU-IC4 units. Once identified, map their current network connections to determine if they are exposed to wider internal segments or the internet. Coordinate with your physical security and OT teams to confirm device ownership and verify your current firmware version, as versions through 1.19.5 are affected.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.