CVE-2025-12217 is a critical issue in Azure Access Technology BLU-IC2 and BLU-IC4 firmware: SNMP default community string. NVD scores it 9.1 and the vector needs no login. The vendor lists firmware 1.20 as the patch release for versions through 1.19.5, so plan an upgrade.
What's affected
The NVD record and the vendor advisory agree on the scope. Azure Access Technology BLU-IC2 and BLU-IC4 devices running firmware through 1.19.5 are affected.
The vendor's advisory page for CVE-2025-12217 lists firmware version 1.19.5 under affected firmware and 1.20 under the versions for which patch releases are available. It lists mitigations as none and states that the vendor was not aware of active exploitation when it published.
The vendor rates this one Medium. NVD gives it 9.1 on CVSS 3.1, so the numbers differ between the two sources. The title here follows the NVD record. When you prioritise, use whichever score your policy names, and weigh how exposed the devices are on your network.
How to check if you're exposed
This is device firmware, so there is no dependency manager to query.
- List every BLU-IC2 and BLU-IC4 unit you operate, from your asset records or a walk of the sites where they are installed.
- Read the firmware version from each device through its normal management interface or the vendor's tools, and compare it to 1.19.5. Anything at 1.19.5 or older is in scope.
- Note which of these devices can be reached from outside a dedicated management network.
On devices and networks you own, you can test whether the default community string is accepted. Run snmpget -v2c -c public 192.0.2.10 1.3.6.1.2.1.1.1.0 against a device address of your own and see if it answers. To find SNMP listeners in a range you manage, use nmap -sU -p 161 192.0.2.0/24. Only do this on equipment you are authorised to test.
What to do now
- Upgrade affected BLU-IC2 and BLU-IC4 units to firmware 1.20, which the vendor lists as the patch release. Confirm the release details with the vendor before you roll out.
- Until then, restrict who can reach the devices. Limit management and any exposed services to named admin hosts.
- Block UDP port 161 at the network edge and between segments, and allow it only from your monitoring hosts.
- If you do not use SNMP on these devices, turn it off where the firmware allows. If you do, check what the vendor says about changing the community string after upgrading.
- Re-read the vendor's security guidelines, which the advisory page points to, and apply the secure setup advice for these devices.
- Record the firmware version after the upgrade so the next audit can see it was done.
Why it matters
The description is a single line: SNMP default community string (public). SNMP versions 1 and 2c use a community string as a shared password, and public is the best known default. A device that answers to it will share whatever its SNMP agent exposes with anyone who can reach the port and asks.
The record uses CWE-1392, use of default credentials. What the agent exposes depends on the device, and the advisory does not list it. NVD's vector rates confidentiality and integrity impact as high and availability as none, which fits a service that reveals data and might accept changes. Default secrets are a leading cause of avoidable incidents because they need no skill to use.
This CVE is one of a group the same vendor published for these two models in October 2025. The vendor's list names researchers who reported them. The record does not say CVE-2025-12217 is exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Is changing the community string enough?
It removes the best known default, which helps. SNMP v1 and v2c send the string in clear text, so also limit which hosts can reach the service. Check the vendor guidance for supported alternatives.
Why is this critical here but medium on the vendor page?
NVD scored it 9.1 from its own vector, and the vendor rated it Medium. Different scoring bodies weigh exposure differently. Use your own context to decide how fast to act.
Sources
Last reviewed: 19 October 2026.
