BLU-IC2/BLU-IC4 vulnerabilities

/etc/timezone can be written arbitrarily, allowing uncontrolled modification of the timezone configuration. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.

/etc/avahi/services/z9.service can be written arbitrarily, allowing uncontrolled modification of the Avahi service configuration. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.

Web UI Malfunction when setting unexpected locale via API. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000). This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Missing Security Headers. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

A vulnerable upgrade feature in BLU-IC2 and BLU-IC4 devices (through version 1.19.5) allows arbitrary file write, potentially leading to obtaining super user permissions on the board.

A vulnerability in BLU-IC2 and BLU-IC4 devices (through version 1.19.5) allows mail configuration file manipulation and command execution. This can lead to full device compromise.

The devices use weak default credentials that can be easily guessed or cracked. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.

Undocumented administrative accounts are being created to facilitate access for applications running on the device. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.

Outdated and Vulnerable UI Dependencies might potentially lead to exploitation. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Systemic lack of Cross-Site Request Forgery (CSRF) token implementation. This issue affects BLU-IC2 through 1.19.5 and BLU-IC4 through 1.19.5.

A local privilege escalation vulnerability. The issue affects BLU-IC2 through 1.19.5 and BLU-IC4 through 1.19.5.

Error messages are returned in HTTP headers in BLU-IC2 and BLU-IC4 devices up to version 1.19.5. This may disclose internal information to a potential attacker.

Email Password Disclosure. This issue affects BLU-IC2 through 1.19.5 and BLU-IC4 through 1.19.5.

Lack of input validation in the web UI might lead to potential exploitation. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.

Logout functionality is not working. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.

Enabled serial console could potentially leak information that might help an attacker to find vulnerabilities. This issue affects BLU-IC2 through 1.19.5 and BLU-IC4 through 1.19.5.

The vulnerability stems from HTTP security misconfiguration — cookies lack Secure and HTTPOnly attributes. This allows reading sensitive cookies from the JavaScript context, e.g., via XSS. It affects BLU-IC2 and BLU-IC4 devices up to version 1.19.5.

Lack of application manifest sanitation could lead to potential stored XSS. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

One of the APIs in BLU-IC2 and BLU-IC4 up to 1.19.5 returns an incorrect Content-Type header (text/html instead of application/json). This may allow injection of HTML/JavaScript into the response.