CVE-2025-12600 is a critical weakness (CVSS 9.8) in Azure Access BLU-IC2 and BLU-IC4 devices: the web interface malfunctions when an unexpected locale is set through the API. The record lists both models through firmware 1.19.5. The vendor advisory page should be checked for the patched release.
What's affected
The record lists the BLU-IC2 and BLU-IC4, along with their firmware, as affected through version 1.19.5. That is the only version information in the record, so any unit on 1.19.5 or earlier should be treated as exposed until the vendor confirms otherwise.
The issue text is short: "Web UI Malfunction when setting unexpected locale via API." The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which means it is reachable over the network, needs no privileges and no user interaction, and has high impact on confidentiality, integrity and availability.
The record describes the trigger as setting an unexpected locale through the API, and the result as a web UI malfunction. It does not spell out more, and this post will not guess at how far the effect goes. The score of 9.8 comes from the vector, which treats the impact as high on all three measures. Read the vendor advisory entry for the exact effect on your units.
The record does not name a fixed firmware. The vendor's security advisory page is the place to confirm the patched version, and it also describes how the vendor handles critical fixes and which versions are supported.
How to check if you're exposed
- List every BLU-IC2 and BLU-IC4 you operate, including units at remote sites. Small embedded devices are easy to forget.
- Open each device's admin interface and note the firmware version. Anything at or below 1.19.5 is in range.
- Find out whether the device can be reached from outside the access control network. Devices like these should live on a dedicated network segment with no internet exposure.
- Open the Azure Access security advisories page, find CVE-2025-12600, and compare the patched version with what you run.
Embedded devices do not show up in package manifests. The free in-browser scan covers your software dependencies, and the Gold page for CVE-2025-12600 tracks this record.
What to do now
- Put every affected device on an isolated network segment and block inbound access from user and guest networks.
- Make sure nothing exposes the devices to the internet, directly or through port forwarding.
- Read the vendor advisory for CVE-2025-12600 and update to the version it names. Take a configuration backup first.
- If your deployment used any secrets or settings shared across devices, plan to rotate them once the firmware is updated.
- Review device logs for unexpected configuration changes or events.
- Add the model to your asset inventory with its firmware version so the next advisory is a lookup, not a hunt.
Why it matters
The record classifies this issue as CWE-730: the CWE entry the record uses for this issue, an older category that groups denial of service style weaknesses. The record itself says only that the web UI malfunctions. If these devices control physical entry or related systems at your site, they are a trust boundary. A device that can be driven by someone who should not be able to talk to it is only as safe as the network around it.
The record does not flag CVE-2025-12600 as a CISA Known Exploited Vulnerability and does not say it is exploited in the wild. The vendor page asks whether exploitation is known at publication, so check it for the latest statement. Because the score is critical, patch planning should not wait.
Quick check
Which models and versions are affected?
The BLU-IC2 and BLU-IC4, through firmware 1.19.5, per the record.
Where do I find the fixed version?
The record does not give one. Use the vendor's security advisories page for the patched release.
Sources
Last reviewed: 19 October 2026.
