CVE-2025-12603 is a critical weakness (CVSS 9.8) in Azure Access BLU-IC2 and BLU-IC4 devices: the file /etc/timezone can be written arbitrarily. The record lists both models through firmware 1.19.5. The vendor advisory page should be checked for the patched release.
What's affected
The record lists the BLU-IC2 and BLU-IC4, along with their firmware, as affected through version 1.19.5. That is the only version information in the record, so any unit on 1.19.5 or earlier should be treated as exposed until the vendor confirms otherwise.
The issue text is short: "/etc/timezone can be Arbitrarily Written." The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which means it is reachable over the network, needs no privileges and no user interaction, and has high impact on confidentiality, integrity and availability.
The affected file is /etc/timezone, a system configuration file. Schedules, access windows and audit logs on many systems depend on correct time, so time related settings are not trivial. The record does not say more about how the write happens, so use the vendor advisory for the technical detail and the patched version.
The record does not name a fixed firmware. The vendor's security advisory page is the place to confirm the patched version, and it also describes how the vendor handles critical fixes and which versions are supported.
How to check if you're exposed
- List every BLU-IC2 and BLU-IC4 you operate, including units at remote sites. Small embedded devices are easy to forget.
- Open each device's admin interface and note the firmware version. Anything at or below 1.19.5 is in range.
- Find out whether the device can be reached from outside the access control network. Devices like these should live on a dedicated network segment with no internet exposure.
- Open the Azure Access security advisories page, find CVE-2025-12603, and compare the patched version with what you run.
Embedded devices do not show up in package manifests. The free in-browser scan covers your software dependencies, and the Gold page for CVE-2025-12603 tracks this record.
What to do now
- Put every affected device on an isolated network segment and block inbound access from user and guest networks.
- Make sure nothing exposes the devices to the internet, directly or through port forwarding.
- Read the vendor advisory for CVE-2025-12603 and update to the version it names. Take a configuration backup first.
- If your deployment used any secrets or settings shared across devices, plan to rotate them once the firmware is updated.
- Review device logs for unexpected configuration changes or events.
- Add the model to your asset inventory with its firmware version so the next advisory is a lookup, not a hunt.
Why it matters
The record classifies this issue as CWE-787: out-of-bounds write, the entry the record uses. The record says a system configuration file can be written to when it should not be. If these devices control physical entry or related systems at your site, they are a trust boundary. A device that can be driven by someone who should not be able to talk to it is only as safe as the network around it.
The record does not flag CVE-2025-12603 as a CISA Known Exploited Vulnerability and does not say it is exploited in the wild. The vendor page asks whether exploitation is known at publication, so check it for the latest statement. Because the score is critical, patch planning should not wait.
Quick check
Which models and versions are affected?
The BLU-IC2 and BLU-IC4, through firmware 1.19.5, per the record.
Where do I find the fixed version?
The record does not give one. Use the vendor's security advisories page for the patched release.
Sources
Last reviewed: 19 October 2026.
