External risk intelligence

BLU-IC2 BLU-IC4 Non-Compliant TLS Configuration

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12478

The affected products are Azure Access BLU-IC2 and BLU-IC4, which are physical access control panels (door controllers). These devices are commonly deployed as edge-facing network appliances managing building security and physical access, making them typically internet-reachable by design to facilitate remote management and connectivity.

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Azure Access BLU-IC2 and BLU-IC4 devices related to non-compliant TLS configurations. This could allow unauthenticated network access to these systems, which manage physical access control. The primary concern is confirming relevance and exposure of these devices within our environment.

Weak encryption settings in access control devices.
Critical unauthenticated network access vulnerability.
Assess exposure of physical access control systems.

Attack Path

How an attacker could exploit the issue

An attacker could compromise systems by exploiting a non-compliant TLS configuration. This vulnerability allows an unauthenticated attacker to remotely access the affected devices, potentially leading to a complete compromise of their security and data.

No authentication required for access.
Attackers can trigger it remotely.
Leads to complete system compromise.

Live Threat

Current exploitation, exposure, and threat context

When TLS is not configured correctly, sensitive information and system functions could be exposed due to a lack of secure communication channels. This could affect both system data and user data when supported by the advisory.

System configuration data.
Data transmitted over unencrypted channels.
Unauthorized access to control functions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Azure Access BLU-IC2 and BLU-IC4 devices, likely managed by infrastructure or platform teams responsible for physical security and network edge devices. The first step is to inventory these devices, determine their network exposure and business criticality, identify the accountable owner, and then plan remediation activities.

Infrastructure and platform teams own this.
Verify device network reachability and criticality.
Plan vendor-coordinated remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the BLU-IC2 and BLU-IC4 hardware?

These devices are specialized physical access control panels produced by Azure Access. They function as edge-facing network appliances responsible for managing building security, such as electronic door locks and facility entry points. Because they facilitate remote management, they are often interconnected with broader building network infrastructure.

What does non-compliant TLS mean in CVE-2025-12478?

This CVE refers to a weakness classified as CWE-326, which involves the use of inadequate or broken cryptographic algorithms. Essentially, the device is failing to establish a sufficiently secure encrypted connection. Because of this flaw, the communication channel between the device and the network is not properly protected, allowing sensitive data or control commands to be intercepted or manipulated.

How does an attacker trigger this vulnerability?

The flaw allows an attacker to interact with the device over the network without requiring any authentication. Because the issue stems from the TLS configuration itself, the vulnerability does not depend on a specific user action or a valid login. If the device is reachable, an attacker can initiate a session to exploit the weak encryption and gain unauthorized control over the system.

Why should I be concerned about my BLU-IC device?

Halo Surface Signal notes that these panels are frequently deployed as edge-facing appliances, making them inherently likely to be accessible over the network. If your devices are reachable from the internet, the lack of robust encryption exposes critical physical security functions to remote compromise, potentially allowing unauthorized individuals to manipulate facility access.

What are the first steps to secure these controllers?

Begin by auditing your environment to locate all active BLU-IC2 and BLU-IC4 units and determine which ones are connected to public or untrusted network segments. Once identified, document the business impact of these specific units and coordinate with your infrastructure team to prioritize a path toward vendor-recommended firmware updates or configuration hardening.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.