CVE-2025-12285 Missing Initial Password Change
Attackers can access BLU-IC2 and BLU-IC4 devices using default credentials because the system fails to enforce an initial password change.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12285?
CVE-2025-12285 is a critical missing authorization vulnerability in Azure Access Technology BLU-IC2, published on 26 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Which versions are affected by CVE-2025-12285?
It affects 2 products.
Products include Azure-Access Blu-Ic2 Firmware, Azure-Access Blu-Ic4 Firmware.
How do I fix CVE-2025-12285?
No fix has been published for CVE-2025-12285 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-12285 being exploited?
There is no known exploitation of CVE-2025-12285 in the wild and no public exploit code.
Other vulnerabilities in Azure Access Technology BLU-IC2
Sources
Also known as GHSA-5pvj-27wv-7mqc.