CVE-2025-12275 is a critical issue in Azure Access Technology BLU-IC2 and BLU-IC4 firmware: mail configuration file manipulation leading to command execution. NVD scores it 9.8 and the vector needs no login. The vendor lists firmware 1.20 as the patch release for versions through 1.19.5, so plan an upgrade.
What's affected
The NVD record and the vendor advisory agree on the scope. Azure Access Technology BLU-IC2 and BLU-IC4 devices running firmware through 1.19.5 are affected.
The vendor's advisory page for CVE-2025-12275 lists firmware version 1.19.5 under affected firmware and 1.20 under the versions for which patch releases are available. It lists mitigations as none and states that the vendor was not aware of active exploitation when it published.
The vendor rates this one High. NVD gives it 9.8 on CVSS 3.1, so the numbers differ between the two sources. The title here follows the NVD record. When you prioritise, use whichever score your policy names, and weigh how exposed the devices are on your network.
How to check if you're exposed
This is device firmware, so there is no dependency manager to query.
- List every BLU-IC2 and BLU-IC4 unit you operate, from your asset records or a walk of the sites where they are installed.
- Read the firmware version from each device through its normal management interface or the vendor's tools, and compare it to 1.19.5. Anything at 1.19.5 or older is in scope.
- Note which of these devices can be reached from outside a dedicated management network.
What to do now
- Upgrade affected BLU-IC2 and BLU-IC4 units to firmware 1.20, which the vendor lists as the patch release. Confirm the release details with the vendor before you roll out.
- Until then, restrict who can reach the devices. Limit management and any exposed services to named admin hosts.
- Restrict access to the device's management functions to named admin hosts, since configuration changes are the likely route.
- After upgrading, review the device's mail settings and compare them to a known good copy.
- Re-read the vendor's security guidelines, which the advisory page points to, and apply the secure setup advice for these devices.
- Record the firmware version after the upgrade so the next audit can see it was done.
Why it matters
The record says mail configuration file manipulation plus command execution. It is terse. It suggests that a value in the device's mail settings can be changed in a way that ends up running commands on the device. The advisory does not say who can make the change or through which interface, so this post will not guess.
The record uses CWE-20, improper input validation. Settings that reach a shell are a classic embedded device mistake. Whenever a configuration value is later passed to a command, it must be validated and escaped. The NVD vector rates the issue network reachable with no privileges and a full impact on confidentiality, integrity and availability.
This CVE is one of a group the same vendor published for these two models in October 2025. The vendor's list names researchers who reported them. The record does not say CVE-2025-12275 is exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Does this need a login?
NVD's vector says no privileges are required. The vendor advisory is brief and does not describe the interface involved, so ask the vendor if you need to know.
What should I look for after upgrading?
Check the device's mail configuration against your records and watch for unexpected outbound connections from the device. The advisory does not give indicators of compromise.
Sources
Last reviewed: 19 October 2026.
