External risk intelligence

Multiple Azure Access BLU-IC Devices Share Secrets Exposing SDKSocket Communication.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12599

The vulnerability involves TCP port 5000 used by SDKSocket in access control hardware. While these devices are often deployed on internal networks for physical security management, the use of a specific TCP socket for remote communication means they are occasionally reachable via network exposure in integrated environments, though they are not typically designed as public-facing internet services.

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability where multiple devices share the same security secrets for SDKSocket communication, potentially allowing unauthorized access. The issue affects specific versions of BLU-IC2 and BLU-IC4 devices.

Devices share secrets, enabling unauthorized access.
Critical flaw impacts access control systems.
Confirm relevance and exposure for security oversight.

Attack Path

How an attacker could exploit the issue

Attackers can reach vulnerable devices over the network because multiple devices share the same secrets for SDKSocket, allowing them to access sensitive information and potentially control device functions. This widespread secret sharing creates a significant security risk for connected systems.

Network access is required to reach devices.
Shared secrets in SDKSocket can be discovered.
Unauthorized access to sensitive data and device control.

Live Threat

Current exploitation, exposure, and threat context

When supported, devices sharing secrets for SDKSocket could expose system and user data. This may occur when multiple devices on the same network use identical credentials for communication. The consequence could be unauthorized access and control over the affected devices.

System and user data at risk.
Shared secrets could be exposed.
Unauthorized access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for device management and network security should prioritize addressing this critical vulnerability. The first practical move is to identify all instances of the affected devices, confirm their network reachability and business criticality, and then assign ownership for remediation planning based on the identified risks.

Device and network teams own resolution.
Verify network exposure and device criticality.
Plan remediation, coordinating with vendor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Azure Access BLU-IC2 and BLU-IC4 hardware?

These are physical access control devices used to manage building security and entry systems. They include firmware that facilitates communication over a dedicated TCP port, known as SDKSocket, to integrate with broader facility management software.

What does CWE-321 mean for CVE-2025-12599?

CWE-321 refers to the use of hard-coded or shared cryptographic keys. In this vulnerability, it means multiple BLU-IC devices are shipped with the exact same security secrets. Because these secrets are not unique, an attacker who discovers the secret for one device can use it to gain unauthorized access to any other device running the same firmware.

Do I need to be local to the device to trigger this flaw?

No. The vulnerability is triggered over a network connection to TCP port 5000. It does not require physical access or local interaction with the hardware. However, the flaw cannot be triggered if the device is completely disconnected from the network or if the SDKSocket service is disabled or blocked at the network level.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal identifies this as a potential risk because while these devices are usually on internal networks, the SDKSocket communication often makes them reachable within integrated environments. Even if not directly on the public internet, any internal system capable of reaching TCP port 5000 on these devices can exploit the shared secret.

How do I begin responding to this security issue?

Start by identifying all BLU-IC2 and BLU-IC4 devices in your environment and mapping which ones are connected to your network. Verify their specific firmware versions and assess their criticality to your operations. Once identified, coordinate with the vendor or your internal security team to plan for firmware updates or network isolation measures to mitigate the risk posed by the shared secrets.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.