CVE-2025-12216 Overview
CVE-2025-12216 affects Azure-Access BLU-IC2 and BLU-IC4 intercom access control devices running firmware versions through 1.19.5. The vulnerability allows an unauthenticated remote attacker to install a malicious or malformed application on the device. Once installed, the application cannot be uninstalled through normal means, and its presence can render the device unavailable. The flaw is categorized under [CWE-1301]: Insufficient or Incomplete Data Removal within Hardware Component. The issue is exploitable over the network without user interaction or prior authentication.
Critical Impact
An unauthenticated network attacker can persistently install a malicious application on BLU-IC2 and BLU-IC4 devices, cause a denial-of-service condition, and prevent uninstallation, resulting in loss of physical access control functionality.
Affected Products
- Azure-Access BLU-IC2 firmware through 1.19.5
- Azure-Access BLU-IC4 firmware through 1.19.5
- Azure-Access BLU-IC2 and BLU-IC4 hardware appliances running affected firmware
Discovery Timeline
- 2025-10-25 - CVE-2025-12216 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12216
Vulnerability Analysis
The BLU-IC2 and BLU-IC4 are IP-based intercom and access control devices used to manage physical entry points. The firmware permits installation of applications through a network-reachable interface without adequate validation of application integrity or authorization of the installing principal. An attacker who reaches the device on the network can push an arbitrary or malformed application package to the unit.
The device does not provide a functional uninstallation path for the resulting application. Whether the app was malicious code or a malformed package that corrupted internal state, the operator cannot remove it through supported administrative workflows. This leads to persistence of attacker-controlled software and, in the malformed case, to conditions where the device stops responding or fails to perform access control functions.
Root Cause
The root cause is insufficient data removal and lifecycle management within the firmware's application subsystem, tracked under [CWE-1301]. The install path lacks authentication and integrity enforcement, and the corresponding uninstall path fails to fully remove application artifacts. This combination violates the principle that any installable component must be reversibly removable by an authorized operator.
Attack Vector
Exploitation requires only network reachability to the device. The attacker sends an installation request carrying a crafted or malicious application payload. Because privileges required and user interaction are both absent from the exploitation path, any adversary who can route packets to a vulnerable BLU-IC2 or BLU-IC4 can trigger the condition. Devices exposed to untrusted network segments, VLANs shared with general users, or the internet face the highest exposure. No public proof-of-concept or in-the-wild exploitation has been reported at the time of writing.
A verified proof-of-concept is not available in public repositories. Refer to the Azure-Access Security Advisories for vendor-provided technical details.
Detection Methods for CVE-2025-12216
Indicators of Compromise
- Unexpected applications listed in the BLU-IC2 or BLU-IC4 administrative console that were not deployed by authorized operators.
- Devices becoming unresponsive to access requests, badge reads, or intercom calls without hardware fault indication.
- Failed uninstall attempts or administrative actions that error out when targeting a specific application on the device.
- Outbound network connections from BLU-IC2 or BLU-IC4 devices to unfamiliar hosts following an installation event.
Detection Strategies
- Baseline the set of applications and firmware versions installed on each BLU-IC2 and BLU-IC4 unit, and alert on any deviation.
- Monitor management-plane traffic to devices for application installation requests originating from unexpected source addresses.
- Correlate device unavailability events with recent configuration or installation changes in the access control management system.
Monitoring Recommendations
- Forward device audit logs and syslog output to a centralized logging platform for retention and correlation.
- Track device network flows on segments hosting BLU-IC2 and BLU-IC4 units to identify anomalous inbound connections to management ports.
- Schedule periodic integrity checks of installed applications against an approved allowlist maintained by the physical security team.
How to Mitigate CVE-2025-12216
Immediate Actions Required
- Inventory all BLU-IC2 and BLU-IC4 devices and identify units running firmware version 1.19.5 or earlier.
- Restrict network access to device management interfaces using access control lists that permit only authorized management workstations.
- Place BLU-IC2 and BLU-IC4 devices on a dedicated, isolated VLAN separated from general user and guest networks.
- Apply the vendor-supplied firmware update as soon as it is available from Azure-Access.
Patch Information
Azure-Access publishes fixes and advisory details on the Azure-Access Security Advisories page. Administrators should consult this page for the fixed firmware version and follow the vendor-provided upgrade procedure for BLU-IC2 and BLU-IC4 devices. Verify firmware image signatures before deployment and confirm the installed version after upgrade.
Workarounds
- Block network access to device application installation endpoints from all sources except a hardened management jump host.
- Disable or firewall off any remote application deployment feature until patched firmware is installed.
- Physically inspect and factory-reset devices suspected of hosting an unauthorized application, then restore configuration from a known-good backup.
- Monitor vendor advisories continuously and subscribe to Azure-Access security notifications for future firmware releases.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
