External risk intelligence

BLU-IC2 and BLU-IC4 Systemic Internal Server Errors

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12515

The affected products, BLU-IC2 and BLU-IC4, are access control hardware devices. Such systems are typically deployed as network-connected edge infrastructure, often with management interfaces or API endpoints that are reachable across a network, making them likely to be encountered in deployments with external-facing or interconnected network exposure.

Azure Access Blu Ic4 Firmware

before 1.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in certain Azure-Access BLU-IC devices, specifically those related to internal server errors. This issue could allow for widespread disruption if exploited, impacting the availability and integrity of critical access control systems. The main concern is to confirm the relevance and exposure of these devices within our environment.

Affects access control devices, causing system errors.
Critical issue due to potential for broad disruption.
Confirm relevance and exposure of affected devices.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component by interacting with network-accessible interfaces of the BLU-IC2 or BLU-IC4 devices. This interaction could be initiated from anywhere on the network, as no specific privileges or user interaction are required. The vulnerability allows an attacker to cause system instability, leading to critical security failures.

No specific entry conditions.
Triggered by network requests.
Leads to critical system failures.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could lead to unexpected system behavior, manifesting as HTTP 500 Internal Server Errors. When supported by the advisory, this could impact the availability of services or data by causing disruptions to normal operations.

System availability and integrity.
Remote unauthenticated network access.
Service disruption and data unavailability.

Operational Fix

Recommended remediation, mitigation, and detection steps

The affected BLU-IC2 and BLU-IC4 devices, likely critical access control systems, present a significant risk due to their network-accessible nature and the potential for widespread impact through internal server errors. The primary concern is confirming the presence and reachability of these devices within the environment. System owners should prioritize identifying all instances of BLU-IC2 and BLU-IC4, assessing their business criticality and network exposure, and locating the accountable teams responsible for their management and remediation.

Ownership: Infrastructure or security teams.
Verify first: Device presence and network exposure.
Action: Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Azure-Access BLU-IC2 and BLU-IC4 technology?

These products are network-connected access control hardware devices. They function as critical infrastructure, often managing physical entry points and security protocols within a facility's network environment.

What does CWE-394 mean for CVE-2025-12515?

CWE-394 refers to a specific weakness involving incomplete processing or errors during a request cycle. In the context of this CVE, it manifests as systemic internal server errors that destabilize the device, potentially allowing an attacker to cause significant service failures.

How is this vulnerability triggered on BLU-IC devices?

The vulnerability is triggered by sending specific network requests to the device. No prior authentication, user interaction, or special privileges are needed to initiate these requests. Simply interacting with the device's network-accessible interfaces is sufficient to trigger the error, meaning typical legitimate traffic patterns do not inherently prevent it.

Is my network-connected BLU-IC device at risk?

If you use these devices, the risk is significant because they often operate as edge infrastructure. Halo Surface Signal indicates these systems are commonly deployed in ways that make their management interfaces or APIs reachable across a network, increasing the likelihood that they could be accessed by unauthorized entities if they are not properly segmented.

What should I do if I manage these access control devices?

Begin by creating an inventory of all BLU-IC2 and BLU-IC4 units in your environment. Prioritize mapping their network connectivity to determine which are exposed. Identify the teams responsible for these systems to coordinate an assessment of their business criticality and determine your path for remediation.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.