CVE-2025-12176 is a critical issue in Azure Access Technology BLU-IC2 and BLU-IC4 firmware: undocumented administrative accounts. NVD scores it 9.8 and the vector needs no login. The vendor lists firmware 1.20 as the patch release for versions through 1.19.5, so plan an upgrade.
What's affected
The NVD record and the vendor advisory agree on the scope. Azure Access Technology BLU-IC2 and BLU-IC4 devices running firmware through 1.19.5 are affected.
The vendor's advisory page for CVE-2025-12176 lists firmware version 1.19.5 under affected firmware and 1.20 under the versions for which patch releases are available. It lists mitigations as none and states that the vendor was not aware of active exploitation when it published.
The vendor rates this one High. NVD gives it 9.8 on CVSS 3.1, so the numbers differ between the two sources. The title here follows the NVD record. When you prioritise, use whichever score your policy names, and weigh how exposed the devices are on your network.
How to check if you're exposed
This is device firmware, so there is no dependency manager to query.
- List every BLU-IC2 and BLU-IC4 unit you operate, from your asset records or a walk of the sites where they are installed.
- Read the firmware version from each device through its normal management interface or the vendor's tools, and compare it to 1.19.5. Anything at 1.19.5 or older is in scope.
- Note which of these devices can be reached from outside a dedicated management network.
What to do now
- Upgrade affected BLU-IC2 and BLU-IC4 units to firmware 1.20, which the vendor lists as the patch release. Confirm the release details with the vendor before you roll out.
- Until then, restrict who can reach the devices. Limit management and any exposed services to named admin hosts.
- After upgrading, review the accounts that exist on each device and remove or disable any that you did not create and that the vendor does not document.
- Rotate credentials on the devices and on any system that stores them, since you cannot know who learned them.
- Re-read the vendor's security guidelines, which the advisory page points to, and apply the secure setup advice for these devices.
- Record the firmware version after the upgrade so the next audit can see it was done.
Why it matters
The NVD description says undocumented administrative accounts were getting created to facilitate access for applications running on board. The vendor advisory calls it undocumented administrative accounts. In short, the device made privileged accounts that its own documentation did not mention, so owners could not know to review or lock them down.
The record classes this as CWE-1242, inclusion of undocumented features or chicken bits. An account that nobody knows about cannot be audited, rotated or removed. Even if the account was created for the device's own software, its credentials and permissions become part of the attack surface. The NVD vector is network based with no privileges required.
This CVE is one of a group the same vendor published for these two models in October 2025. The vendor's list names researchers who reported them. The record does not say CVE-2025-12176 is exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
How can I tell if my device has the hidden accounts?
The advisory does not publish the account names. Compare the account list on a device against what you created, and ask the vendor for guidance. Firmware through 1.19.5 is in scope.
Do I need to reset passwords after upgrading?
The advisory does not say. Rotating device credentials after the upgrade is a sensible precaution when undocumented accounts existed. Check what the vendor recommends.
Sources
Last reviewed: 19 October 2026.
