CVE-2025-12599 is a critical weakness (CVSS 9.8) in Azure Access BLU-IC2 and BLU-IC4 devices: multiple devices share the same secrets for the SDKSocket service on TCP port 5000. The record lists both models through firmware 1.19.5. The vendor advisory page should be checked for the patched release.
What's affected
The record lists the BLU-IC2 and BLU-IC4, along with their firmware, as affected through version 1.19.5. That is the only version information in the record, so any unit on 1.19.5 or earlier should be treated as exposed until the vendor confirms otherwise.
The issue text is short: "Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)." The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which means it is reachable over the network, needs no privileges and no user interaction, and has high impact on confidentiality, integrity and availability.
In plain terms, the SDKSocket service listens on TCP port 5000, and the record says devices share the same secrets for it. A shared secret is not a secret once one unit is analysed. Any protection that relies on it applies to every device built the same way. Rotating it per device is the usual fix, and that needs a vendor firmware change.
The record does not name a fixed firmware. The vendor's security advisory page is the place to confirm the patched version, and it also describes how the vendor handles critical fixes and which versions are supported.
How to check if you're exposed
- List every BLU-IC2 and BLU-IC4 you operate, including units at remote sites. Small embedded devices are easy to forget.
- Open each device's admin interface and note the firmware version. Anything at or below 1.19.5 is in range.
- Find out whether the device can be reached from outside the access control network. Devices like these should live on a dedicated network segment with no internet exposure.
- Open the Azure Access security advisories page, find CVE-2025-12599, and compare the patched version with what you run.
Embedded devices do not show up in package manifests. The free in-browser scan covers your software dependencies, and the Gold page for CVE-2025-12599 tracks this record.
What to do now
- Put every affected device on an isolated network segment and block inbound access from user and guest networks.
- Make sure nothing exposes the devices to the internet, directly or through port forwarding.
- Read the vendor advisory for CVE-2025-12599 and update to the version it names. Take a configuration backup first.
- If your deployment used any secrets or settings shared across devices, plan to rotate them once the firmware is updated.
- Review device logs for unexpected configuration changes or events.
- Add the model to your asset inventory with its firmware version so the next advisory is a lookup, not a hunt.
Try it yourself
Click through it at your own pace, or open it full screen.
Why it matters
The record classifies this issue as CWE-321: use of a hard-coded cryptographic key. When many devices ship with the same secret, learning it from one unit is enough to impersonate the rest. If these devices control physical entry or related systems at your site, they are a trust boundary. A device that can be driven by someone who should not be able to talk to it is only as safe as the network around it.
The record does not flag CVE-2025-12599 as a CISA Known Exploited Vulnerability and does not say it is exploited in the wild. The vendor page asks whether exploitation is known at publication, so check it for the latest statement. Because the score is critical, patch planning should not wait.
Quick check
Which models and versions are affected?
The BLU-IC2 and BLU-IC4, through firmware 1.19.5, per the record.
Where do I find the fixed version?
The record does not give one. Use the vendor's security advisories page for the patched release.
Sources
Last reviewed: 19 October 2026.
