CVE-2025-12104 is a critical issue in Azure Access Technology BLU-IC2 and BLU-IC4 firmware: outdated and vulnerable UI dependencies. NVD scores it 9.8 and the vector needs no login. The vendor lists firmware 1.20 as the patch release for versions through 1.19.5, so plan an upgrade.
What's affected
The NVD record and the vendor advisory agree on the scope. Azure Access Technology BLU-IC2 and BLU-IC4 devices running firmware through 1.19.5 are affected.
The vendor's advisory page for CVE-2025-12104 lists firmware version 1.19.5 under affected firmware and 1.20 under the versions for which patch releases are available. It lists mitigations as none and states that the vendor was not aware of active exploitation when it published.
The vendor rates this one High. NVD gives it 9.8 on CVSS 3.1, so the numbers differ between the two sources. The title here follows the NVD record. When you prioritise, use whichever score your policy names, and weigh how exposed the devices are on your network.
How to check if you're exposed
This is device firmware, so there is no dependency manager to query.
-
List every BLU-IC2 and BLU-IC4 unit you operate, from your asset records or a walk of the sites where they are installed.
-
Read the firmware version from each device through its normal management interface or the vendor's tools, and compare it to 1.19.5. Anything at 1.19.5 or older is in scope.
-
Note which of these devices can be reached from outside a dedicated management network.
-
If you ship web interfaces or embedded firmware of your own, generate a software bill of materials for them and scan it. The free in-browser dependency scan at gold.safeguard.sh/scan can check a manifest without any setup.
What to do now
- Upgrade affected BLU-IC2 and BLU-IC4 units to firmware 1.20, which the vendor lists as the patch release. Confirm the release details with the vendor before you roll out.
- Until then, restrict who can reach the devices. Limit management and any exposed services to named admin hosts.
- Do not assume the vendor fix covers libraries you added yourself. Check any customisations against a dependency scan.
- Subscribe to the vendor's advisory page so you see the next notice early.
- Re-read the vendor's security guidelines, which the advisory page points to, and apply the secure setup advice for these devices.
- Record the firmware version after the upgrade so the next audit can see it was done.
Why it matters
The record is short. NVD describes outdated and vulnerable UI dependencies that might potentially lead to exploitation, and the vendor advisory repeats that wording. It does not name the libraries or the CVEs inside them, so the exact exploit paths are not stated.
The record assigns CWE-1104, use of unmaintained third party components. That vagueness is common for dependency findings, and it is the reason software composition analysis exists. A web interface built from old libraries inherits every known flaw in those versions. The device maker may not even use the vulnerable code paths, but an outside tester cannot always tell, so the finding is reported at the component level.
This CVE is one of a group the same vendor published for these two models in October 2025. The vendor's list names researchers who reported them. The record does not say CVE-2025-12104 is exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What are the vulnerable dependencies?
The vendor advisory and the NVD record do not name them. They only say the UI dependencies are outdated and vulnerable. Ask the vendor for the component list if you need it for a risk assessment.
How do I find outdated dependencies in my own products?
Create a software bill of materials, then compare each component and version against a vulnerability database. A dependency scan automates that comparison, and reachability analysis helps you decide which findings matter first.
Sources
Last reviewed: 19 October 2026.
