CVE-2025-12285 is a critical issue in Azure Access Technology BLU-IC2 and BLU-IC4 firmware: missing initial password change. NVD scores it 9.8 and the vector needs no login. The vendor lists firmware 1.20 as the patch release for versions through 1.19.5, so plan an upgrade.
What's affected
The NVD record and the vendor advisory agree on the scope. Azure Access Technology BLU-IC2 and BLU-IC4 devices running firmware through 1.19.5 are affected.
The vendor's advisory page for CVE-2025-12285 lists firmware version 1.19.5 under affected firmware and 1.20 under the versions for which patch releases are available. It lists mitigations as none and states that the vendor was not aware of active exploitation when it published.
The vendor rates this one High. NVD gives it 9.8 on CVSS 3.1, so the numbers differ between the two sources. The title here follows the NVD record. When you prioritise, use whichever score your policy names, and weigh how exposed the devices are on your network.
How to check if you're exposed
This is device firmware, so there is no dependency manager to query.
- List every BLU-IC2 and BLU-IC4 unit you operate, from your asset records or a walk of the sites where they are installed.
- Read the firmware version from each device through its normal management interface or the vendor's tools, and compare it to 1.19.5. Anything at 1.19.5 or older is in scope.
- Note which of these devices can be reached from outside a dedicated management network.
Walk through each unit and confirm that its password is not the factory value. If you inherit devices from an installer, assume nothing and test with your password manager's record of the current login.
What to do now
- Upgrade affected BLU-IC2 and BLU-IC4 units to firmware 1.20, which the vendor lists as the patch release. Confirm the release details with the vendor before you roll out.
- Until then, restrict who can reach the devices. Limit management and any exposed services to named admin hosts.
- Set a unique, long password on every unit and record it in your password manager.
- Add a step to your install checklist so new units never go live with the initial password.
- Re-read the vendor's security guidelines, which the advisory page points to, and apply the secure setup advice for these devices.
- Record the firmware version after the upgrade so the next audit can see it was done.
Why it matters
The record is two words: missing initial password change. The device did not make the installer set a new password on first use, so a factory default can stay in place for the life of the device. The advisory does not give the default values and neither does this post.
The record lists CWE-20 and CWE-521, weak password requirements. This is the process side of the default credential problem described in CVE-2025-12218. One CVE is about the default being weak, and this one is about the device not forcing a change. Together they mean a unit can sit on a network with a login that anyone can find. The NVD vector is network based with no privileges required.
This CVE is one of a group the same vendor published for these two models in October 2025. The vendor's list names researchers who reported them. The record does not say CVE-2025-12285 is exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Will firmware 1.20 force a password change?
The advisory lists 1.20 as the patch release but does not describe the new behaviour. Test it on a spare unit and change passwords yourself either way.
Is this the same as CVE-2025-12218?
No. CVE-2025-12218 covers weak default credentials, and this one covers the missing prompt to change the initial password. They are related and best fixed together.
Sources
Last reviewed: 19 October 2026.
