External risk intelligence

BLU-IC2 and BLU-IC4 Web UI Locale Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12600

The vulnerability affects the Web UI and API of these devices. These components are commonly deployed as network-accessible management interfaces or portals, making them reachable in typical deployments where the device is configured for remote management or web-based interaction over the network.

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the web user interface of certain devices, stemming from how unexpected locale settings are handled via an API. This could potentially lead to system malfunctions, impacting the usability and integrity of the affected components. The main concern at this time is to confirm whether these specific devices are in use and exposed to this potential issue.

Web UI malfunction via API.
Leadership should track relevant devices.
Confirm device relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach a vulnerable component by interacting with the web user interface or API of affected devices. The vulnerability occurs when an unexpected locale is set via the API. This malfunction in the web UI could lead to a critical compromise of the system.

No authentication or privileges needed.
Setting an unexpected locale via API.
Complete system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the web user interface and API functionality of certain devices when an unexpected locale is set. This may lead to unexpected service behavior or an inability to manage the device.

Device web UI and API.
Unexpected locale set via API.
Disruption of device management.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability likely affects the Web UI and API of network-accessible management interfaces or portals. Technical leaders and security teams should first identify where these devices are deployed, confirm network reachability and business criticality, and then locate the accountable owner for remediation planning.

Identify affected devices and owners.
Verify network exposure and business impact.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the BLU-IC2 and BLU-IC4 hardware used for?

BLU-IC2 and BLU-IC4 are access control and management devices produced by Azure Access. They are typically deployed as physical security controllers or smart portals that use a built-in Web UI and API to allow administrators to manage facility access, monitor hardware status, and configure system settings over a network.

What does CVE-2025-12600 mean by Web UI malfunction?

This vulnerability, classified as CWE-730, involves improper handling of data inputs. When an API request sends an unexpected or malformed locale setting—the information determining language and regional preferences—the system's Web UI fails to process it correctly. This breakdown can escalate beyond a simple interface glitch, potentially resulting in a full compromise of system integrity and control.

How is this vulnerability triggered by an attacker?

An attacker triggers this issue by sending a specially crafted API request that specifies an unsupported or unexpected locale. It is important to note that this does not require the attacker to have existing credentials, account privileges, or pre-established access. Normal operation or standard web browsing does not trigger the bug; it requires deliberate interaction with the API.

Is my device vulnerable according to Halo Surface Signal?

If your device is configured for remote management or web-based interaction, Halo Surface Signal flags it as likely reachable. Because the vulnerability exists within the network-accessible Web UI and API, any device connected to the network—especially those exposed to the internet—faces a higher risk of being targeted.

What steps should I take if I use these devices?

Begin by creating an inventory of all BLU-IC2 and BLU-IC4 units within your environment to identify their locations and business roles. Once mapped, verify their network accessibility to determine which are reachable by unauthorized users. Finally, coordinate with your system owners to review your current firmware versions and prepare for updates that address this issue.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.