External risk intelligence

BLU-IC2 and BLU-IC4 Lack CSRF Protection.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12479

The affected products, BLU-IC2 and BLU-IC4, are access control and identity management systems. Such appliances are commonly deployed as network-edge or internet-facing gateways to manage physical access, making their web interfaces and API endpoints regular targets for public internet exposure in typical enterprise and facility deployments.

Cross-site Request Forgery

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability is a systemic lack of security protection against certain types of web attacks, affecting specific access control systems. The absence of proper security measures means an attacker could potentially take control of these systems without needing any credentials or prior access. The main concern is to confirm if these systems are in use and potentially exposed.

System weakness allows unauthorized control of access systems.
Leadership should remember this impacts critical security infrastructure.
Confirm relevance and exposure of access control systems.

Attack Path

How an attacker could exploit the issue

An attacker can initiate an attack without any prior authentication by leveraging a system that lacks proper Cross-Site Request Forgery (CSRF) token implementation. This exposure allows an attacker to trick a user into unknowingly submitting a malicious request to the vulnerable system. The vulnerability resides in the web interface of the BLU-IC2 and BLU-IC4 devices, and when triggered, it can lead to significant compromise of the system's security.

No authentication required.
Triggered via user interaction.
High risk of system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to perform unauthorized actions on behalf of a logged-in user within the affected systems. The specific risk depends on the configuration and network exposure of the BLU-IC2 and BLU-IC4 devices, which are typically used for access control and identity management.

System access control configurations at risk.
Unauthorized actions via crafted requests.
Compromised physical or digital access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for application security, infrastructure, and potentially vendor management will need to address this vulnerability. The first practical step is to identify all instances of the affected BLU-IC products, determine their network exposure and criticality, locate the accountable system owner, and then plan remediation or mitigation strategies based on the assessed risk.

Ownership likely falls to infrastructure or security teams.
Verify product deployment and network reachability.
Coordinate with vendor for remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the BLU-IC2 and BLU-IC4 system?

BLU-IC2 and BLU-IC4 are specialized hardware devices from Azure Access designed for physical access control and identity management. These appliances act as security gateways that manage entry permissions to facilities or sensitive areas. Because they control physical access, their interfaces often integrate with building management networks, serving as critical infrastructure for maintaining site security and authentication.

What does CWE-352 mean for CVE-2025-12479?

CWE-352 refers to Cross-Site Request Forgery (CSRF). In the context of this CVE, it means the web interface of the affected devices lacks security tokens designed to verify that a request was intentionally initiated by an authorized user. Without these tokens, the system cannot distinguish between a legitimate command from an administrator and a malicious command triggered by an attacker, effectively allowing unauthorized actions to be processed as if they were authentic.

How is this vulnerability triggered?

An attacker triggers this flaw by tricking an authenticated user's browser into sending a malicious request to the vulnerable device. The attack relies on the absence of validation tokens on the device's web interface. Note that the vulnerability is not triggered by direct brute-force password guessing; instead, it exploits the trust the device places in the user's browser session, allowing unauthorized commands to execute without the user's knowledge.

How do I know if my devices are relevant?

According to Halo Surface Signal, these appliances are frequently deployed as network-edge or internet-facing gateways, which significantly increases their risk profile. If your BLU-IC2 or BLU-IC4 units have management interfaces reachable via the public internet, they are at higher risk of being targeted. You should prioritize assets that are exposed externally over those strictly isolated within an internal, protected network segment.

What should I do first to address this?

Your first step is to inventory all BLU-IC2 and BLU-IC4 devices in your environment to understand your total footprint. Once located, verify the network configuration for each device to determine if it is exposed to the internet. Identify the system owners responsible for these assets and coordinate with them to check for official vendor updates or mitigation guidance provided by the manufacturer to secure these gateways.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.