NVD disclosure day
CVE-2025-12601
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A network-based denial-of-service vulnerability exists in BLU-IC2 and BLU-IC4 devices, potentially causing service disruption. Unauthenticated attackers can exploit this by sending numerous slow network requests. Affected systems, if reachable, could become unresponsive, impacting access control operations.
CVE-2025-12600
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability exists in the web UI and API of certain devices, allowing unexpected locale settings to cause malfunctions. If reachable, this could lead to critical system compromise, impacting device management and availability. This is relevant for security-aware leaders to track and confirm device usage and exposur
CVE-2025-12599
Halo Surface Signal: 3 out of 5 — possibly public-facing.
The Azure Access BLU-IC2 and BLU-IC4 devices share identical secrets for SDKSocket communication, creating a vulnerability. If reachable over the network, this could allow unauthorized access to device functions and sensitive data.
CVE-2025-11499
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A WordPress plugin used for contact forms and data management has a critical vulnerability allowing unauthenticated attackers to upload arbitrary files to the server. This could potentially lead to remote code execution if the site is configured to permit unauthenticated users to add featured images.
CVE-2025-11833
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the Post SMTP WordPress plugin allows unauthenticated attackers to access sensitive email logs, potentially including password reset links, which could lead to account takeover.