PatchTheCVE: blu-ic4 firmwarehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-12554: Missing Security Headers.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.https://patchthecve.com/cve/CVE-2025-12554.htmlhttps://patchthecve.com/cve/CVE-2025-12554.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Missing Security Headers.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12553: Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.https://patchthecve.com/cve/CVE-2025-12553.htmlhttps://patchthecve.com/cve/CVE-2025-12553.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12552: Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.https://patchthecve.com/cve/CVE-2025-12552.htmlhttps://patchthecve.com/cve/CVE-2025-12552.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12517: Credits Page not Matching Versions in Use in the FirmwareThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: https://patchthecve.com/cve/CVE-2025-12517.htmlhttps://patchthecve.com/cve/CVE-2025-12517.htmlSun, 18 Oct 2026 00:10:00 +0000MEDIUM 5.3: Credits Page not Matching Versions in Use in the FirmwareThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-12516: Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1https://patchthecve.com/cve/CVE-2025-12516.htmlhttps://patchthecve.com/cve/CVE-2025-12516.htmlSun, 18 Oct 2026 00:10:00 +0000CRITICAL 9.8: Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-12515: Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: throughttps://patchthecve.com/cve/CVE-2025-12515.htmlhttps://patchthecve.com/cve/CVE-2025-12515.htmlSun, 18 Oct 2026 00:10:00 +0000CRITICAL 9.8: Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-12479: Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation.This issue affects BLU-IC2: through 1.https://patchthecve.com/cve/CVE-2025-12479.htmlhttps://patchthecve.com/cve/CVE-2025-12479.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 8.8: Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-12478: Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .https://patchthecve.com/cve/CVE-2025-12478.htmlhttps://patchthecve.com/cve/CVE-2025-12478.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-12477: Server Version Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .https://patchthecve.com/cve/CVE-2025-12477.htmlhttps://patchthecve.com/cve/CVE-2025-12477.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Server Version Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-12476: Resource Lacking AuthN.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .https://patchthecve.com/cve/CVE-2025-12476.htmlhttps://patchthecve.com/cve/CVE-2025-12476.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Resource Lacking AuthN.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-12425: Local Privilege Escalation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .https://patchthecve.com/cve/CVE-2025-12425.htmlhttps://patchthecve.com/cve/CVE-2025-12425.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.8: Local Privilege Escalation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-12424: Privilege Escalation through SUID-bit Binary.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19https://patchthecve.com/cve/CVE-2025-12424.htmlhttps://patchthecve.com/cve/CVE-2025-12424.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Privilege Escalation through SUID-bit Binary.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-12423: Protocol manipulation might lead to denial of service.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: thrhttps://patchthecve.com/cve/CVE-2025-12423.htmlhttps://patchthecve.com/cve/CVE-2025-12423.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.5: Protocol manipulation might lead to denial of service.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-12422: Vulnerable Upgrade Feature (Arbitrary File Write) may lead to obtaining super user permissions on board.This ihttps://patchthecve.com/cve/CVE-2025-12422.htmlhttps://patchthecve.com/cve/CVE-2025-12422.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vulnerable Upgrade Feature (Arbitrary File Write) may lead to obtaining super user permissions on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12365: Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.https://patchthecve.com/cve/CVE-2025-12365.htmlhttps://patchthecve.com/cve/CVE-2025-12365.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.3: Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12364: Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.https://patchthecve.com/cve/CVE-2025-12364.htmlhttps://patchthecve.com/cve/CVE-2025-12364.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12363: Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.https://patchthecve.com/cve/CVE-2025-12363.htmlhttps://patchthecve.com/cve/CVE-2025-12363.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.5: Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12285: Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.https://patchthecve.com/cve/CVE-2025-12285.htmlhttps://patchthecve.com/cve/CVE-2025-12285.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12284: Lack of Input Validation in the web UI might lead to potential exploitation.This issue affects BLU-IC2: throughttps://patchthecve.com/cve/CVE-2025-12284.htmlhttps://patchthecve.com/cve/CVE-2025-12284.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.1: Lack of Input Validation in the web UI might lead to potential exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12278: Logout Functionality not Working.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.https://patchthecve.com/cve/CVE-2025-12278.htmlhttps://patchthecve.com/cve/CVE-2025-12278.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.5: Logout Functionality not Working.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12275: Mail Configuration File Manipulation + Command Execution.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: https://patchthecve.com/cve/CVE-2025-12275.htmlhttps://patchthecve.com/cve/CVE-2025-12275.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Mail Configuration File Manipulation + Command Execution.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12221: Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1https://patchthecve.com/cve/CVE-2025-12221.htmlhttps://patchthecve.com/cve/CVE-2025-12221.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 8.8: Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12220: Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1https://patchthecve.com/cve/CVE-2025-12220.htmlhttps://patchthecve.com/cve/CVE-2025-12220.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12219: Vulnerable Components in Azure Access OS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.https://patchthecve.com/cve/CVE-2025-12219.htmlhttps://patchthecve.com/cve/CVE-2025-12219.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vulnerable Components in Azure Access OS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12218: Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.https://patchthecve.com/cve/CVE-2025-12218.htmlhttps://patchthecve.com/cve/CVE-2025-12218.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.1: Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12217: SNMP Default Community String (public).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.https://patchthecve.com/cve/CVE-2025-12217.htmlhttps://patchthecve.com/cve/CVE-2025-12217.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.1: SNMP Default Community String (public).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12216: Malicious / Malformed App can be Installed but not Uninstalled/may lead to unavailability.This issue affects Bhttps://patchthecve.com/cve/CVE-2025-12216.htmlhttps://patchthecve.com/cve/CVE-2025-12216.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.5: Malicious / Malformed App can be Installed but not Uninstalled/may lead to unavailability.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12176: Undocumented administrative accounts were getting created to facilitate access for applications running on boahttps://patchthecve.com/cve/CVE-2025-12176.htmlhttps://patchthecve.com/cve/CVE-2025-12176.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12114: Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.Thihttps://patchthecve.com/cve/CVE-2025-12114.htmlhttps://patchthecve.com/cve/CVE-2025-12114.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.5: Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12104: Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: thrhttps://patchthecve.com/cve/CVE-2025-12104.htmlhttps://patchthecve.com/cve/CVE-2025-12104.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12031: HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute may allow reading the sensitive cookieshttps://patchthecve.com/cve/CVE-2025-12031.htmlhttps://patchthecve.com/cve/CVE-2025-12031.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.3: HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute may allow reading the sensitive cookies from the javascript contextThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12001: Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: throughhttps://patchthecve.com/cve/CVE-2025-12001.htmlhttps://patchthecve.com/cve/CVE-2025-12001.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.1: Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-11925: Incorrect Content-Type header in one of the APIs (`text/html` instead of `application/json`) replies may potenhttps://patchthecve.com/cve/CVE-2025-11925.htmlhttps://patchthecve.com/cve/CVE-2025-11925.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.1: Incorrect Content-Type header in one of the APIs (`text/html` instead of `application/json`) replies may potentially allow injection of HTML/JavaScript into reply.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-11832: Allocation of Resources Without Limits or Throttling vulnerability in Azure Access Technology BLU-IC2, Azure Ahttps://patchthecve.com/cve/CVE-2025-11832.htmlhttps://patchthecve.com/cve/CVE-2025-11832.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Allocation of Resources Without Limits or Throttling vulnerability in Azure Access Technology BLU-IC2, Azure Access Technology BLU-IC4 allows Flooding.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.