Blu Ic2 Firmware

CVEs (37)

CVE	Vendor / Product	Sev	Risk	CVSS	Published	Description
CVE-2025-12218	Azure Access BLU-IC4	Cri	0.59	9.1	Oct 25, 2025	Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12217	BLU IC4	Cri	0.59	9.1	Oct 25, 2025	SNMP Default Community String (public).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12479	BLU IC4	Hig	0.57	8.8	Oct 29, 2025	Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVE-2025-12221	Busybox Busybox	Hig	0.57	8.8	Oct 25, 2025	Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12425	BLU IC4	Hig	0.51	7.8	Oct 28, 2025	Local Privilege Escalation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVE-2025-12601	BLU IC2	Hig	0.49	7.5	Nov 1, 2025	Denial of Service Due to SlowLoris.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12423	Azure Access BLU-IC4	Hig	0.49	7.5	Oct 28, 2025	Protocol manipulation might lead to denial of service.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVE-2025-12363	Azure Access BLU-IC4	Hig	0.49	7.5	Oct 27, 2025	Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12278	BLU IC4	Med	0.42	6.5	Oct 26, 2025	Logout Functionality not Working.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12284	BLU IC4	Med	0.40	6.1	Oct 26, 2025	Lack of Input Validation in the web UI might lead to potential exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12001	BLU IC4	Med	0.40	6.1	Oct 20, 2025	Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-11925	Azure Access BLU-IC4	Med	0.40	6.1	Oct 17, 2025	Incorrect Content-Type header in one of the APIs (`text/html` instead of `application/json`) replies may potentially allow injection of HTML/JavaScript into reply.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12216	Azure Access BLU-IC4	Med	0.36	5.5	Oct 25, 2025	Malicious / Malformed App can be Installed but not Uninstalled/may lead to unavailability.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12114	BLU IC2	Med	0.36	5.5	Oct 23, 2025	Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12517	BLU IC4	Med	0.34	5.3	Oct 30, 2025	Credits Page not Matching Versions in Use in the FirmwareThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVE-2025-12365	BLU IC2	Med	0.34	5.3	Oct 27, 2025	Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12031	BLU IC BLU-IC	Med	0.34	5.3	Oct 21, 2025	HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute may allow reading the sensitive cookies from the javascript contextThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVE-2025-12218CriOct 25, 2025
Azure Access
BLU-IC4
risk 0.59cvss 9.1epss 0.00
Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12217CriOct 25, 2025
BLU
IC4
risk 0.59cvss 9.1epss 0.00
SNMP Default Community String (public).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12479HigOct 29, 2025
BLU
IC4
risk 0.57cvss 8.8epss 0.00
Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVE-2025-12221HigOct 25, 2025
Busybox
Busybox
risk 0.57cvss 8.8epss 0.00
Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12425HigOct 28, 2025
BLU
IC4
risk 0.51cvss 7.8epss 0.00
Local Privilege Escalation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVE-2025-12601HigNov 1, 2025
BLU
IC2
risk 0.49cvss 7.5epss 0.00
Denial of Service Due to SlowLoris.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12423HigOct 28, 2025
Azure Access
BLU-IC4
risk 0.49cvss 7.5epss 0.00
Protocol manipulation might lead to denial of service.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVE-2025-12363HigOct 27, 2025
Azure Access
BLU-IC4
risk 0.49cvss 7.5epss 0.00
Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12278MedOct 26, 2025
BLU
IC4
risk 0.42cvss 6.5epss 0.00
Logout Functionality not Working.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12284MedOct 26, 2025
BLU
IC4
risk 0.40cvss 6.1epss 0.00
Lack of Input Validation in the web UI might lead to potential exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12001MedOct 20, 2025
BLU
IC4
risk 0.40cvss 6.1epss 0.00
Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-11925MedOct 17, 2025
Azure Access
BLU-IC4
risk 0.40cvss 6.1epss 0.00
Incorrect Content-Type header in one of the APIs (`text/html` instead of `application/json`) replies may potentially allow injection of HTML/JavaScript into reply.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12216MedOct 25, 2025
Azure Access
BLU-IC4
risk 0.36cvss 5.5epss 0.00
Malicious / Malformed App can be Installed but not Uninstalled/may lead to unavailability.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12114MedOct 23, 2025
BLU
IC2
risk 0.36cvss 5.5epss 0.00
Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12517MedOct 30, 2025
BLU
IC4
risk 0.34cvss 5.3epss 0.00
Credits Page not Matching Versions in Use in the FirmwareThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVE-2025-12365MedOct 27, 2025
BLU
IC2
risk 0.34cvss 5.3epss 0.00
Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12031MedOct 21, 2025
BLU IC
BLU-IC
risk 0.34cvss 5.3epss 0.00
HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute may allow reading the sensitive cookies from the javascript contextThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Page 2 of 2