External risk intelligence

BLU-IC2 and BLU-IC4 Lack Graceful Error Handling Leading to HTTP 5xx Errors

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12516

The affected products, BLU-IC2 and BLU-IC4, are access control panels commonly deployed as networked edge devices. These appliances manage physical security and are frequently exposed to network interfaces for remote management and connectivity, making them likely to be reachable from the internet in standard deployment scenarios.

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Azure Access BLU-IC2 and BLU-IC4 devices due to improper handling of errors. This flaw could allow attackers to gain unauthorized access and control over critical systems.

Flaw in error handling affects access control devices.
Critical issue impacts physical security and remote management.
Confirm relevance and exposure for critical access systems.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerability by sending specially crafted network requests to the affected devices without requiring any authentication or privileges. The issue lies in how the system handles errors, potentially allowing an attacker to trigger a denial-of-service condition and gain unauthorized access.

No authentication or privileges needed.
Triggered by malformed network requests.
Can lead to denial of service and unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect system data and service behavior when error handling fails. Supported conditions might allow unauthorized disclosure or modification of system information.

System data and service behavior at risk.
Graceful error handling failure may expose data.
Unauthorized disclosure or modification of information.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the network-accessible nature of BLU-IC2 and BLU-IC4, infrastructure or platform teams responsible for device management should take the lead. The immediate priority is to identify all deployed instances, confirm their reachability and criticality, and ascertain the accountable system owner before planning any remediation.

Infrastructure or platform teams own remediation.
Verify device reachability and criticality.
Plan coordinated remediation or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the BLU-IC2 and BLU-IC4 hardware used for?

The BLU-IC2 and BLU-IC4 are access control panels designed by Azure Access. These devices function as networked edge appliances that manage physical security infrastructure, such as electronic door locks and building entry points, often requiring remote connectivity for centralized management.

What does CWE-394 mean for CVE-2025-12516?

CWE-394 refers to a lack of graceful error handling. In this specific vulnerability, the software fails to manage unexpected input correctly when generating HTTP 5xx error responses. This flaw can cause the system to behave unpredictably, potentially allowing unauthorized access or modification of the device's functions.

How do attackers trigger this vulnerability?

An attacker triggers this flaw by sending specially crafted network requests to the device. No user privileges, login credentials, or authentication are required to initiate the attack. Simply interacting with the network interface in this unintended way is sufficient; standard, well-formed requests that do not cause error-handling failures will not trigger the bug.

Do I need to worry if my device is internal?

Halo Surface Signal notes that these devices are frequently internet-facing as part of standard network deployments. While devices on restricted, internal-only networks face a lower risk of remote attack, you should verify if your specific deployment allows any external reachability, as the vulnerability is triggered via network communication.

What should I do first to address this CVE?

Your first step is to perform an inventory of all BLU-IC2 and BLU-IC4 units in your environment. Infrastructure teams should verify the physical location and network accessibility of each device to understand which units are most critical. Once identified, coordinate with the accountable system owners to prepare for vendor-supplied updates or security patches.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.