CVE-2025-12104
Published: 23 October 2025
Summary
CVE-2025-12104 is a critical-severity Use of Unmaintained Third Party Components (CWE-1104) vulnerability in Azure-Access Blu-Ic2 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of software flaws, directly addressing vulnerabilities from outdated UI dependencies.
Mandates continuous vulnerability scanning and monitoring to identify outdated and vulnerable UI dependencies prior to exploitation.
Maintains an inventory of system components including UI dependencies, enabling tracking and prioritization for updates.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows remote attackers with network access (AV:N/AC:L/PR:N/UI:N) to achieve full system compromise via exploitation of outdated and vulnerable UI dependencies in a public-facing application.
NVD Description
Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Deeper analysisAI
CVE-2025-12104, published on 2025-10-23, is a vulnerability stemming from outdated and vulnerable UI dependencies that might potentially lead to exploitation. It affects BLU-IC2 versions through 1.19.5 and BLU-IC4 versions through 1.19.5. The issue is classified under CWE-1104 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.
Remote attackers require only network access to exploit this vulnerability, with low attack complexity, no privileges, and no user interaction needed. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing full system compromise.
Mitigation details are available in the security advisory at https://azure-access.com/security-advisories.
Details
- CWE(s)