CVE-2025-12477 is a Critical (CVSS 9.8) issue in Azure Access Technology BLU-IC2 and BLU-IC4 access controllers, firmware through 1.19.5: a server version disclosure. The vendor lists firmware 1.20 as the patched release. Update affected devices and limit who can reach their management interface.
What's affected
The NVD record lists the BLU-IC2 and BLU-IC4 and their firmware, through 1.19.5. The vendor advisory for this CVE names the same two models and firmware 1.19.5, and says patch releases are available in 1.20. The advisory describes server version disclosure.
Weakness class: CWE-306 (Missing Authentication for Critical Function).
The vendor advisory also states that there are no listed mitigations and that it was not aware of active exploitation at the time of publication. The vendor labels its own severity for this issue as high, while the NVD record carries a CVSS score of 9.8 (critical). When two sources disagree, treat the higher figure as the planning number until you know how the device is deployed.
How to check if you're exposed
There is no package to query here, so the check is about devices and firmware:
- List every BLU-IC2 and BLU-IC4 in your access control estate from your asset inventory or the management system you use for them.
- Read the firmware version on each device. Anything up to and including 1.19.5 is in scope. The vendor wiki and product documentation describe where the version is shown.
- Record where each device sits on the network and who can reach its web interface.
- Check whether any device is reachable from the internet. If yes, fix that first.
What to do now
- Plan an upgrade of each affected device to firmware 1.20 or later, following the vendor release notes and testing on one door first.
- Move the management interface to a dedicated network and block internet access to it.
- Change default and shared passwords to long, unique ones, and restrict who holds administrator rights.
- Review the vendor security advisories page regularly, since the vendor has published many entries for these models in a short period.
- Write down the firmware version for each device in your inventory so the next advisory takes minutes to check.
Why it matters
When a server reveals its exact version, anyone scanning your network learns which known flaws to look for. It is a small leak that makes other problems easier to find. Access controllers decide who opens physical doors, so a weak spot in the software is a physical security matter as well as an IT one.
This CVE is one of a group the vendor published together for the same models, all fixed by the same firmware line. That makes the upgrade more valuable than any single entry suggests. The CVE is not in the CISA Known Exploited Vulnerabilities catalog and the vendor says it was not aware of active exploitation when it published.
Quick check
Which firmware version fixes CVE-2025-12477?
The vendor advisory lists 1.20 as the patch release. Confirm the exact release notes with the vendor before you roll it out.
Why does the vendor severity differ from the NVD score?
They are separate ratings from different sources. The NVD record shows 9.8, the vendor lists its own label. Use the higher one for planning until you know the exposure.
Sources
- Azure Access Technology security advisories
- Azure Access advisory page for CVE-2025-12477
- Safeguard Gold entry for CVE-2025-12477
- NVD record for CVE-2025-12477 (published 29 October 2025), the basis for the scores, weakness classes and affected product data above
Last reviewed: 19 October 2026.
