External risk intelligence

BLU-IC2 and BLU-IC4 Privilege Escalation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12425

The vulnerability is explicitly identified as a Local Privilege Escalation. Such flaws require a user to already have local access to the system to exploit, making it inherently a local-only issue rather than one that is reachable via public internet exposure.

Privilege Escalation

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a local privilege escalation vulnerability affecting specific Azure-Access BLU-IC technologies. The issue could allow an attacker with existing local access to gain higher privileges on the affected systems, potentially leading to broader compromise. The main concern is confirming relevance and exposure for these specific technologies.

Allows local users to gain more power.
Critical issue if affected BLU-IC devices are in use.
Verify if your BLU-IC devices are impacted.

Attack Path

How an attacker could exploit the issue

Attackers with initial access to a system could exploit this vulnerability to elevate their privileges. This could involve interacting with vulnerable components of BLU-IC2 or BLU-IC4, potentially leading to system compromise. The exact attack journey and the specific actions required to trigger the vulnerability are not detailed in the provided information.

Requires local system access.
Vulnerable BLU-IC2 or BLU-IC4 components.
Risk of privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

The described local privilege escalation vulnerability in BLU-IC2 and BLU-IC4 devices could allow an attacker with local access to gain elevated privileges. This could potentially expose system data and sensitive information, impacting the confidentiality and integrity of the device's operations and any connected systems.

System configuration and access logs.
Local access is required for exploitation.
Unauthorized system control or data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability impacts the BLU-IC2 and BLU-IC4 systems, likely managed by infrastructure and platform teams responsible for the underlying operating environments. The immediate priority is to inventory all instances of these affected systems, confirm their reachability and business criticality, and identify the accountable system owners to initiate a coordinated remediation plan.

Own the issue and remediation plan.
Verify system inventory and exposure.
Plan and coordinate system updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Azure-Access BLU-IC2 and BLU-IC4 software?

These products are specialized hardware and firmware solutions from Azure-Access used to manage physical access control systems. Organizations deploy them to monitor and secure entry points within a facility. The firmware acts as the internal operating system controlling these devices.

What does Local Privilege Escalation mean for CVE-2025-12425?

This vulnerability falls under the Improper Privilege Management weakness class. It means that someone who has already gained a low-level account or limited session on the device can bypass security restrictions to gain administrative or 'root' access, granting them full control over the system's functions.

How is this vulnerability triggered?

An attacker must already have physical or logical access to the local system to trigger this flaw. It cannot be initiated by simply sending remote commands or network packets. If you do not allow local terminal or console access to the device, the conditions required to initiate this privilege escalation are not met.

Do I need to worry if my BLU-IC devices are on the internet?

While network reachability is often a concern, Halo Surface Signal notes this is a local-only issue. Because the vulnerability requires existing local access, an internet-facing device is not directly exploitable from a remote network location. The primary risk remains someone already operating within the local environment.

What should I do first to address this CVE?

Begin by auditing your hardware inventory to identify any BLU-IC2 or BLU-IC4 units running firmware versions 1.19.5 or older. Once you have a complete list of impacted devices, coordinate with your infrastructure team to plan a firmware update to version 1.20 or higher.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.