CVE-2025-12220 is a critical issue in Azure Access Technology BLU-IC2 and BLU-IC4 firmware: BusyBox 1.31.1 with multiple known vulnerabilities. NVD scores it 9.8 and the vector needs no login. The vendor lists firmware 1.20 as the patch release for versions through 1.19.5, so plan an upgrade.
What's affected
The NVD record and the vendor advisory agree on the scope. Azure Access Technology BLU-IC2 and BLU-IC4 devices running firmware through 1.19.5 are affected.
The vendor's advisory page for CVE-2025-12220 lists firmware version 1.19.5 under affected firmware and 1.20 under the versions for which patch releases are available. It lists mitigations as none and states that the vendor was not aware of active exploitation when it published.
The vendor rates this one High. NVD gives it 9.8 on CVSS 3.1, so the numbers differ between the two sources. The title here follows the NVD record. When you prioritise, use whichever score your policy names, and weigh how exposed the devices are on your network.
How to check if you're exposed
This is device firmware, so there is no dependency manager to query.
- List every BLU-IC2 and BLU-IC4 unit you operate, from your asset records or a walk of the sites where they are installed.
- Read the firmware version from each device through its normal management interface or the vendor's tools, and compare it to 1.19.5. Anything at 1.19.5 or older is in scope.
- Note which of these devices can be reached from outside a dedicated management network.
If you can open a shell on a device or on an image you build, busybox | head -n 1 prints the version banner. For container images, a scan of the image will list BusyBox and its version along with the known CVEs. For fleets you cannot log into, rely on the firmware version and the vendor notice.
What to do now
- Upgrade affected BLU-IC2 and BLU-IC4 units to firmware 1.20, which the vendor lists as the patch release. Confirm the release details with the vendor before you roll out.
- Until then, restrict who can reach the devices. Limit management and any exposed services to named admin hosts.
- For images you build, replace old BusyBox versions with a maintained release and rebuild.
- Scan your images before you ship them so an old base layer does not arrive in production unnoticed.
- Re-read the vendor's security guidelines, which the advisory page points to, and apply the secure setup advice for these devices.
- Record the firmware version after the upgrade so the next audit can see it was done.
Why it matters
NVD records this as BusyBox 1.31.1 with multiple known vulnerabilities. BusyBox packs small versions of many Unix tools into one binary and is common in routers, cameras and other embedded Linux devices. Version 1.31.1 is an older release, and the vendor advisory says the affected devices ship it.
The record carries no CWE for this issue, so there is no weakness page to link. A bundled copy of an old BusyBox carries every flaw published against that release. Which of them can be reached depends on the applets the device uses and how it exposes them. The advisory does not list individual BusyBox CVEs, so the NVD score is a worst case view.
This CVE is one of a group the same vendor published for these two models in October 2025. The vendor's list names researchers who reported them. The record does not say CVE-2025-12220 is exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does upgrading BusyBox fix the device?
The vendor lists firmware 1.20 as the patch release. Whether that release changes the BusyBox version is not stated in the advisory, so verify it with the vendor or in a test unit.
How do I find BusyBox in my own images?
Scan the image or its software bill of materials. A scanner lists BusyBox, its version and the CVEs that apply, and you can then rebuild from a newer base image.
Sources
Last reviewed: 19 October 2026.
