CVE-2025-12218 is a critical issue in Azure Access Technology BLU-IC2 and BLU-IC4 firmware: weak default credentials. NVD scores it 9.1 and the vector needs no login. The vendor lists firmware 1.20 as the patch release for versions through 1.19.5, so plan an upgrade.
What's affected
The NVD record and the vendor advisory agree on the scope. Azure Access Technology BLU-IC2 and BLU-IC4 devices running firmware through 1.19.5 are affected.
The vendor's advisory page for CVE-2025-12218 lists firmware version 1.19.5 under affected firmware and 1.20 under the versions for which patch releases are available. It lists mitigations as none and states that the vendor was not aware of active exploitation when it published.
The vendor rates this one High. NVD gives it 9.1 on CVSS 3.1, so the numbers differ between the two sources. The title here follows the NVD record. When you prioritise, use whichever score your policy names, and weigh how exposed the devices are on your network.
How to check if you're exposed
This is device firmware, so there is no dependency manager to query.
- List every BLU-IC2 and BLU-IC4 unit you operate, from your asset records or a walk of the sites where they are installed.
- Read the firmware version from each device through its normal management interface or the vendor's tools, and compare it to 1.19.5. Anything at 1.19.5 or older is in scope.
- Note which of these devices can be reached from outside a dedicated management network.
The simplest check is process based: confirm that someone changed the factory login on every unit, and that the change is recorded. If you cannot show that, treat the device as exposed. Also look at your logs for repeated failed or unexpected logins to the devices.
What to do now
- Upgrade affected BLU-IC2 and BLU-IC4 units to firmware 1.20, which the vendor lists as the patch release. Confirm the release details with the vendor before you roll out.
- Until then, restrict who can reach the devices. Limit management and any exposed services to named admin hosts.
- Change every default or shared password on the devices to a unique, long value, and store it in your password manager.
- Where the firmware supports it, turn on account lockout or logging for failed logins, and send the logs to a central place.
- Re-read the vendor's security guidelines, which the advisory page points to, and apply the secure setup advice for these devices.
- Record the firmware version after the upgrade so the next audit can see it was done.
Why it matters
The description is only two words long: weak default credentials. The vendor advisory is equally brief. It does not state the credentials, and this post will not guess them. The point is that out of the box, these devices shipped with a login that is easy to guess or widely known.
The record uses CWE-1392, use of default credentials. Default logins are the cheapest way into a device that sits on a network. They require no exploit at all, only a login attempt. The NVD vector is network based, needs no privileges, and rates confidentiality and integrity impact as high with no availability impact.
This CVE is one of a group the same vendor published for these two models in October 2025. The vendor's list names researchers who reported them. The record does not say CVE-2025-12218 is exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
What are the default credentials?
The vendor advisory and NVD do not publish them. Do not rely on secrecy. Assume anyone with network access can guess them and change them everywhere.
Does upgrading to firmware 1.20 change the credentials?
The advisory does not say. Verify the behaviour on a test unit and change the login yourself either way.
Sources
Last reviewed: 19 October 2026.
