External risk intelligence

Email Server Certificate Verification Disabled in BLU-IC2 and BLU-IC4

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12553

The product is an email server, which is a network service designed to facilitate communication. Email servers are commonly deployed as internet-facing components to send and receive messages, making the underlying protocol handling and certificate verification mechanisms part of a primary, externally reachable surface.

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects email servers by disabling a crucial security check for digital certificates, which could potentially allow unauthorized access or manipulation of communications. The main concern is confirming relevance and exposure.

Email servers may not verify sender identities.
Critical for protecting sensitive communications.
Assess your email server's exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target an organization's email servers by exploiting a flaw in how they verify security certificates. This vulnerability, present in certain versions of BLU-IC email server software, allows an unauthenticated attacker to bypass secure communication checks. Successful exploitation could lead to significant compromise of the email server's confidentiality, integrity, and availability.

No authentication needed to attack.
Email server's certificate checks are bypassed.
High risk to server data and operations.

Live Threat

Current exploitation, exposure, and threat context

When email server certificate verification is disabled, sensitive information within email communications and the integrity of the email service could be compromised. This could occur if the email server does not properly validate the digital certificates of other servers it communicates with, potentially allowing for man-in-the-middle attacks or communication with malicious servers.

Email server integrity and confidentiality.
Attacks could intercept or redirect email.
Compromised email, potential data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in email server certificate verification impacts BLU-IC2 and BLU-IC4 devices through version 1.19.5. Given the nature of email servers, infrastructure and security teams are likely responsible for these systems. The immediate priority is to identify all instances of the affected technology, confirm their network exposure and business criticality, and then initiate a risk-based remediation plan.

Infrastructure and security teams own this.
Verify network exposure and business criticality.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is BLU-IC2 and BLU-IC4?

BLU-IC2 and BLU-IC4 are email server systems developed by Azure Access. These products function as core network services designed to facilitate the sending, receiving, and routing of digital communications within an organization’s infrastructure.

What does CVE-2025-12553 mean by certificate verification being disabled?

This vulnerability is classified as CWE-599, which occurs when a system fails to properly check the digital certificates of entities it communicates with. Essentially, the software trusts incoming or outgoing connections without verifying their cryptographic identity, leaving the communication channel open to impersonation.

How does an attacker trigger this vulnerability?

An attacker can exploit this flaw without needing any prior authentication or credentials. By placing themselves in the communication path between your email server and another party, they can intercept traffic. Note that simply using the email server for standard, legitimate traffic does not trigger the bug; the risk arises when the server processes connections from unverified or malicious sources that take advantage of the disabled certificate checks.

Is my email server vulnerable to this attack?

Halo Surface Signal indicates that because these devices act as internet-facing email services, they are often reachable from external networks. If your instance is exposed to the internet to handle mail traffic, it is significantly more likely to be reachable by external attackers attempting to exploit this certificate validation weakness.

What steps should I take if I am running affected software?

First, inventory your network to identify all instances of BLU-IC2 and BLU-IC4 running version 1.19.5 or earlier. Once identified, prioritize these systems based on their business criticality and network exposure, and coordinate with your infrastructure team to plan and implement the necessary software updates to restore secure certificate verification.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.