CVE-2025-12515 is a Critical (CVSS 9.8) issue in Azure Access Technology BLU-IC2 and BLU-IC4 access controllers, firmware through 1.19.5: systemic internal server errors (http 500). The vendor lists firmware 1.20 as the patched release. Update affected devices and limit who can reach their management interface.
What's affected
The NVD record lists the BLU-IC2 and BLU-IC4 and their firmware, through 1.19.5. The vendor advisory for this CVE names the same two models and firmware 1.19.5, and says patch releases are available in 1.20. The advisory describes systemic internal server errors with HTTP 500 responses.
Weakness class: CWE-394 (Unexpected Status Code or Return Value).
The vendor advisory also states that there are no listed mitigations and that it was not aware of active exploitation at the time of publication. The vendor labels its own severity for this issue as high, while the NVD record carries a CVSS score of 9.8 (critical). When two sources disagree, treat the higher figure as the planning number until you know how the device is deployed.
How to check if you're exposed
There is no package to query here, so the check is about devices and firmware:
- List every BLU-IC2 and BLU-IC4 in your access control estate from your asset inventory or the management system you use for them.
- Read the firmware version on each device. Anything up to and including 1.19.5 is in scope. The vendor wiki and product documentation describe where the version is shown.
- Record where each device sits on the network and who can reach its web interface.
- Check whether any device is reachable from the internet. If yes, fix that first.
What to do now
- Plan an upgrade of each affected device to firmware 1.20 or later, following the vendor release notes and testing on one door first.
- Move the management interface to a dedicated network and block internet access to it.
- Change default and shared passwords to long, unique ones, and restrict who holds administrator rights.
- Review the vendor security advisories page regularly, since the vendor has published many entries for these models in a short period.
- Write down the firmware version for each device in your inventory so the next advisory takes minutes to check.
Why it matters
Pages that fail with server errors on routine requests point to missing checks on how the code handles unexpected states, and may leak internal detail or cause outages. Access controllers decide who opens physical doors, so a weak spot in the software is a physical security matter as well as an IT one.
This CVE is one of a group the vendor published together for the same models, all fixed by the same firmware line. That makes the upgrade more valuable than any single entry suggests. The CVE is not in the CISA Known Exploited Vulnerabilities catalog and the vendor says it was not aware of active exploitation when it published.
Quick check
Which firmware version fixes CVE-2025-12515?
The vendor advisory lists 1.20 as the patch release. Confirm the exact release notes with the vendor before you roll it out.
Why does the vendor severity differ from the NVD score?
They are separate ratings from different sources. The NVD record shows 9.8, the vendor lists its own label. Use the higher one for planning until you know the exposure.
Sources
- Azure Access Technology security advisories
- Azure Access advisory page for CVE-2025-12515
- Safeguard Gold entry for CVE-2025-12515
- NVD record for CVE-2025-12515 (published 30 October 2025), the basis for the scores, weakness classes and affected product data above
Last reviewed: 19 October 2026.
