External risk intelligence

BLU-IC2 and BLU-IC4 Protocol Manipulation Denial of Service

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12423

The affected products, BLU-IC2 and BLU-IC4, are access control controllers typically deployed as networked infrastructure components. Such devices are often managed or connected via network interfaces to facilitate remote administration or integration within building security systems, making them plausibly exposed to network-based interaction in many operational environments.

Denial of Service

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in BLU-IC2 and BLU-IC4 access control systems that could allow for denial of service. The issue stems from a flaw in how the system handles certain network protocols, potentially leading to disruptions in access control operations if exploited. While the direct business impact requires further assessment of deployment specifics, the critical nature of the vulnerability warrants attention.

Protocol flaw can disrupt system access.
Critical flaw impacts core access control.
Confirm relevance and exposure status.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerability by manipulating network protocols, potentially affecting the availability of building access control systems. This manipulation targets specific features within the BLU-IC2 and BLU-IC4 devices. If successful, the manipulation could disrupt normal operations, leading to a denial-of-service condition.

Network protocol manipulation is required.
Vulnerable devices are triggered by protocol manipulation.
Risk is denial of service.

Live Threat

Current exploitation, exposure, and threat context

Protocol manipulation could lead to a denial of service affecting the availability of system controls. This could occur when network-based attacks target the communication protocols of BLU-IC2 and BLU-IC4 devices. The main risk is the potential disruption of access control services.

Access control system availability.
Networked devices could be targeted.
Disruption of critical services.

Operational Fix

Recommended remediation, mitigation, and detection steps

This protocol manipulation vulnerability impacts BLU-IC2 and BLU-IC4 devices, which are network-connected access control controllers. Given their typical deployment in building security systems, both infrastructure and security teams should collaborate to identify affected assets. The first practical step is to determine the network exposure and business criticality of these devices to prioritize remediation efforts and identify the accountable owner.

Infrastructure and security teams own this.
Verify network exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the BLU-IC2 and BLU-IC4 software?

These products are hardware access control controllers manufactured by Azure Access. They serve as the central processing units for building security systems, managing networked locks, sensors, and badge readers to regulate physical entry into protected areas.

What does CWE-248 mean for CVE-2025-12423?

The vulnerability is classified as CWE-248, which relates to an uncaught exception. In the context of this CVE, it means the system does not properly handle errors occurring during specific network protocol operations. When this exception is triggered, the controller may crash or stop responding, resulting in a denial of service.

How is this vulnerability triggered?

The flaw is triggered by an attacker sending specifically crafted or manipulated network protocol traffic to the controller. The vulnerability is not triggered by standard, legitimate management traffic or routine physical activity at the access control point; it requires unauthorized, malicious interaction with the device's network-facing interface.

Why should I care about CVE-2025-12423?

Halo Surface Signal indicates that BLU-IC2 and BLU-IC4 controllers are frequently deployed as networked infrastructure, often with interfaces accessible over the network for remote management. If your controller is connected to a network that an attacker can reach, the device is at risk of being remotely forced offline, potentially disabling the physical security controls it manages.

How do I respond to this threat?

Begin by auditing your infrastructure to locate all BLU-IC2 and BLU-IC4 controllers and identify their network placement. Determine if these devices are exposed to untrusted networks and assess the criticality of the controlled access points. Coordinate with the teams responsible for physical security and network infrastructure to prioritize securing or isolating these assets while monitoring vendor channels for official firmware updates.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.