CVE-2025-12425
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A local privilege escalation vulnerability. The issue affects BLU-IC2 through 1.19.5 and BLU-IC4 through 1.19.5.
Risk Assessment
A local attacker could elevate their privileges on the system, potentially leading to full control of the device.
Recommendation
Update BLU-IC2 and BLU-IC4 device software to a version later than 1.19.5.
Other vulnerabilities in BLU-IC2/BLU-IC4
See all- CVE-2025-12603Critical
/etc/timezone can be written arbitrarily, allowing uncontrolled modification of the timezone configuration. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12602Critical
/etc/avahi/services/z9.service can be written arbitrarily, allowing uncontrolled modification of the Avahi service configuration. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12600Critical
Web UI Malfunction when setting unexpected locale via API. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CVE-2025-12599Critical
Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000). This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CVE-2025-12554Critical
Missing Security Headers. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CVE-2025-12422Critical
A vulnerable upgrade feature in BLU-IC2 and BLU-IC4 devices (through version 1.19.5) allows arbitrary file write, potentially leading to obtaining super user permissions on the board.
- CVE-2025-12275Critical
A vulnerability in BLU-IC2 and BLU-IC4 devices (through version 1.19.5) allows mail configuration file manipulation and command execution. This can lead to full device compromise.
- CVE-2025-12218Critical
The devices use weak default credentials that can be easily guessed or cracked. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12176Critical
Undocumented administrative accounts are being created to facilitate access for applications running on the device. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
- CVE-2025-12104Critical
Outdated and Vulnerable UI Dependencies might potentially lead to exploitation. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Original NVD description (English source)
Local Privilege Escalation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
Vulnerability data from NVD (NIST) · CISA KEV · EPSS