External risk intelligence

Denial of Service vulnerability in BLU-IC2 and BLU-IC4 firmware.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12601

The affected products, BLU-IC2 and BLU-IC4, are physical access control panels typically deployed as edge-facing devices in security networks. These controllers often require network connectivity to communicate with management servers or cloud interfaces, making them commonly reachable edge components in physical security deployments.

Denial of Service

Azure Access Blu Ic2 Firmware

before 1.20

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recently identified vulnerability could impact specific access control devices, potentially leading to denial of service. This issue is characterized by its ability to exploit network-based weaknesses, making the affected systems a potential target. The primary concern is to confirm whether these specific devices are deployed within our environment and assess any associated exposure.

Slow network requests can disrupt service.
Affects network-connected access control devices.
Confirm relevance and exposure for these devices.

Attack Path

How an attacker could exploit the issue

Attackers can initiate a denial-of-service attack by sending a flood of incomplete connection requests to vulnerable BLU-IC devices. These devices, which manage physical access, can become overwhelmed and unresponsive if they are exposed to the network without proper protection. This vulnerability can render the access control systems inoperable.

No authentication or user interaction needed.
Incomplete network connection requests.
System becomes unresponsive.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to disrupt the normal operation of access control systems, potentially leading to temporary unavailability of their services when exposed to a network. The specific impact depends on the system's configuration and role within the network.

Network-connected access control system.
Attacker sends many slow connections.
Temporary service unavailability.

Operational Fix

Recommended remediation, mitigation, and detection steps

The identified Denial of Service vulnerability impacting BLU-IC2 and BLU-IC4 devices requires immediate attention from infrastructure and security teams. The first practical step is to inventory all instances of these devices, confirm their network exposure and business criticality, and identify the accountable system owners. Remediation planning should then prioritize the most critical and exposed systems.

Infrastructure and Security teams own this vulnerability.
Verify network reachability and criticality of devices.
Plan and execute vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the purpose of BLU-IC2 and BLU-IC4 devices?

These devices are physical access control panels. They function as edge-facing controllers in security networks, managing the hardware that grants or restricts entry to facilities. They typically maintain network connectivity to communicate with central management servers or cloud-based administrative interfaces.

What does CWE-730 mean for CVE-2025-12601?

This vulnerability relates to how the system handles network requests. Specifically, it involves a SlowLoris attack pattern where the system is overwhelmed by incomplete connection requests. This weakness allows an attacker to tie up the device's resources by keeping many connections open slowly, eventually causing the system to become unresponsive.

How is this Denial of Service triggered?

An attacker initiates the attack by sending a flood of partial or slow network requests to the device. This does not require any prior authentication or user interaction. Simple, legitimate-looking but incomplete traffic is sufficient to trigger the issue, meaning standard authorized users are not required to participate in the process.

Why should I care about this if my devices are internal?

Halo Surface Signal notes that BLU-IC2 and BLU-IC4 are commonly deployed as edge-facing components. While devices directly on the internet are at highest risk, any controller reachable over the network could be targeted by an attacker who has gained a foothold elsewhere in your environment. You should assess if your network architecture allows reachability.

What is the first step to address this CVE?

Begin by creating an inventory of all BLU-IC2 and BLU-IC4 units in your environment to determine where they are located. Identify the system owners and verify the network reachability of each device. Once you have identified these assets, coordinate with your infrastructure teams to prioritize those that are most critical or have the highest level of network exposure.

References

azure-access.com/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.