CVE-2025-12176
Azure-Access Blu-Ic2 Firmware ≤ 1.20
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-12176 is a critical-severity Inclusion of Undocumented Features or Chicken Bits (CWE-1242) vulnerability in Azure-Access Blu-Ic2 Firmware. Its CVSS base score is 10.0 (Critical).
Operationally, ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-7 (Least Functionality) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-35874
Vulnerability Data
Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.3.4
Mitigating Controls (NIST 800-53 r5) AI
Least-functionality configuration can disable or remove non-essential capabilities once discovered, limiting the blast radius of any undocumented chicken bits that remain.
Documented development standards and processes directly require that all device features be specified and recorded, preventing hidden chicken bits from being introduced.
An SDLC that incorporates security requires all features to be captured in requirements and design artifacts, stopping undocumented capabilities from being added.
Security engineering principles applied during design explicitly call for complete, documented functionality and the avoidance of hidden or undeclared mechanisms.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can uncover undocumented functionality before release.
Secure development life cycle requires documented design and review, reducing hidden or undocumented features.
Secure system architecture and engineering principles mandate documented, minimal, and auditable designs, limiting chicken bits.
Secure coding standards and peer review detect and prohibit undocumented or debug features.
Change management processes require documented approvals, reducing the chance of hidden features being introduced.
Configuration management enforces documented, approved configurations, limiting undocumented hardware or firmware features.