External risk intelligence

BLU-IC2 and BLU-IC4 Server Version Disclosure Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12477

The affected products, BLU-IC2 and BLU-IC4, are access control panels commonly deployed as internet-facing or network-connected edge devices for facility management and security infrastructure. These devices often require remote connectivity for management and monitoring, making them accessible via network interfaces in common deployment scenarios.

Missing Authentication

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in BLU-IC devices that can disclose server version information. This disclosure could potentially enable attackers to identify and exploit further weaknesses in the system. Understanding the potential impact on access control systems is paramount for leadership.

Server version information can be exposed.
Critical disclosure could enable further attacks.
Confirm relevance and exposure in your environment.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by accessing the network-connected access control devices, such as BLU-IC2 and BLU-IC4, which are likely exposed to the internet or internal networks. By querying these devices, an attacker can obtain server version information. This disclosed information can then be used to identify specific vulnerabilities associated with that version, facilitating targeted attacks.

Network access required.
Query device for version.
Enables targeted attacks.

Live Threat

Current exploitation, exposure, and threat context

The vulnerability could allow an unauthenticated attacker to discover sensitive server version information. This information, when combined with other potential vulnerabilities, might assist an attacker in understanding the system's environment and planning further attacks.

Server version disclosure.
Network access could reveal version.
Assists further attack planning.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability affects Azure Access BLU-IC2 and BLU-IC4 devices. Infrastructure or platform teams are likely responsible for managing these devices, with potential involvement from security operations and vendor management teams. The immediate first step is to inventory all instances of the affected technology, confirm their network reachability and criticality, and identify the accountable owner to plan a risk-based remediation strategy.

Identify affected device inventory.
Verify network exposure and criticality.
Plan remediation with accountable owner.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the BLU-IC2 and BLU-IC4 software?

These are access control panels manufactured by Azure Access. They function as edge devices within physical security infrastructure, managing electronic locks and credentials to secure facilities. They act as the intelligent gateway between the physical door and your security management network.

What does Server Version Disclosure mean in CVE-2025-12477?

This vulnerability, categorized under CWE-306, describes a weakness where the device reveals its software version to unauthorized users. While version numbers seem minor, they act as a map for attackers, allowing them to pinpoint specific, known flaws in your unique firmware version to tailor their next steps.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending specific network queries to the device. They do not need to log in or hold valid credentials to get a response. Simply interacting with the device's network interface is enough; passive, non-malicious network monitoring or routine background tasks will not cause this disclosure.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal identifies these panels as likely internet-facing or network-connected edge devices. If your BLU-IC2 or BLU-IC4 is reachable from the public internet or an untrusted segment of your network, your risk is higher because attackers can remotely query the device to discover its version without needing local access.

What are the first steps to address this CVE?

Start by inventorying your facility's deployment to find all active BLU-IC2 and BLU-IC4 units. Once identified, confirm which devices have network paths that reach outside your trusted internal environment. Coordinate with your infrastructure owners to document these assets and prepare for the required firmware updates.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.