CVE-2025-11832 is a critical issue in Azure Access Technology BLU-IC2 and BLU-IC4 firmware: APIs lack rate limiting. NVD scores it 9.8 and the vector needs no login. The vendor lists firmware 1.20 as the patch release for versions through 1.19.5, so plan an upgrade.
What's affected
The NVD record and the vendor advisory agree on the scope. Azure Access Technology BLU-IC2 and BLU-IC4 devices running firmware through 1.19.5 are affected.
The vendor's advisory page for CVE-2025-11832 lists firmware version 1.19.5 under affected firmware and 1.20 under the versions for which patch releases are available. It lists mitigations as none and states that the vendor was not aware of active exploitation when it published.
The vendor rates this one High (CVSS 4.0). NVD gives it 9.8 on CVSS 3.1, so the numbers differ between the two sources. The title here follows the NVD record. When you prioritise, use whichever score your policy names, and weigh how exposed the devices are on your network.
How to check if you're exposed
This is device firmware, so there is no dependency manager to query.
- List every BLU-IC2 and BLU-IC4 unit you operate, from your asset records or a walk of the sites where they are installed.
- Read the firmware version from each device through its normal management interface or the vendor's tools, and compare it to 1.19.5. Anything at 1.19.5 or older is in scope.
- Note which of these devices can be reached from outside a dedicated management network.
What to do now
- Upgrade affected BLU-IC2 and BLU-IC4 units to firmware 1.20, which the vendor lists as the patch release. Confirm the release details with the vendor before you roll out.
- Until then, restrict who can reach the devices. Limit management and any exposed services to named admin hosts.
- Where you can, place the devices behind a gateway or firewall that limits request rates. That is a workaround and not a fix.
- Watch device availability and response times so a flood shows up as an alert and not as a mystery outage.
- Re-read the vendor's security guidelines, which the advisory page points to, and apply the secure setup advice for these devices.
- Record the firmware version after the upgrade so the next audit can see it was done.
Why it matters
The vendor describes the issue as APIs that lack rate limiting. The NVD description calls it allocation of resources without limits or throttling, which allows flooding. In plain terms, a client can send a great many requests and the device does not slow it down or refuse the extra work.
The weakness is CWE-770, allocation of resources without limits or throttling. Embedded devices have small processors and little memory. Without a limit, a flood of requests can starve the device of resources and leave it unresponsive. NVD's vector is network based with no login needed, which is why the score is high.
This CVE is one of a group the same vendor published for these two models in October 2025. The vendor's list names researchers who reported them. The record does not say CVE-2025-11832 is exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Does CVE-2025-11832 let someone take over the device?
The advisory text only says the APIs lack rate limiting, and the NVD description talks about flooding. NVD's vector rates impact as high across the board, but read the vendor page for what it says about real impact.
Which firmware fixes it?
The vendor advisory lists firmware 1.20 as the version for which patch releases are available. Confirm the details with the vendor before you deploy.
Sources
Last reviewed: 19 October 2026.
