NVD disclosure day
CVE-2025-12220
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in BusyBox, a component of Azure Access BLU-IC2 and BLU-IC4 devices, potentially allowing unauthorized access and control. The issue affects device confidentiality, integrity, and availability when network-connected and reachable. Confirming relevance and exposure is crucial due to the p
CVE-2025-12219
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability affects Azure Access OS components, specifically BLU-IC2 and BLU-IC4. This flaw, exploitable via network requests, could allow unauthenticated attackers to compromise system integrity, availability, and confidentiality. The nature of these components in access control systems necessitates a rev
CVE-2025-12218
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Weak default credentials in BLU-IC2 and BLU-IC4 devices allow unauthenticated network access. This could lead to unauthorized control over physical access systems, potentially impacting confidentiality, integrity, and availability. The absence of strong authentication for these devices necessitates immediate assessment
CVE-2025-12216
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in BLU-IC2 and BLU-IC4 firmware allows a malicious application to be installed and resist uninstallation, potentially leading to service unavailability. The affected technology is network-connected physical access control hardware. The specific impact depends on the installation and reachability of thes