azure-access vulnerabilities

Recent CVEs affecting azure-access products. 34 tracked.

azure-access has 34 tracked vulnerabilities, 20 critical. A fixed release or vendor patch exists for 34. Most recent: 2025-10-31. Highest priority: CVE-2025-12275 (score 51/100).

CVE-2025-12275 CRITICAL 9.8 UPGRADE UPGRADE Mail Configuration File Manipulation + Command Execution.This issue affects BLU-IC2: through 1.19.5; BLU-IC4:
CVE-2025-12422 CRITICAL 9.8 UPGRADE UPGRADE Vulnerable Upgrade Feature (Arbitrary File Write) may lead to obtaining super user permissions on board.This i
CVE-2025-12104 CRITICAL 9.8 UPGRADE UPGRADE Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: thr
CVE-2025-12219 CRITICAL 9.8 UPGRADE UPGRADE Vulnerable Components in Azure Access OS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12220 CRITICAL 9.8 UPGRADE UPGRADE Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1
CVE-2025-12554 CRITICAL 9.8 UPGRADE UPGRADE Missing Security Headers.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-11832 CRITICAL 9.8 UPGRADE UPGRADE Allocation of Resources Without Limits or Throttling vulnerability in Azure Access Technology BLU-IC2, Azure A
CVE-2025-12176 CRITICAL 9.8 UPGRADE UPGRADE Undocumented administrative accounts were getting created to facilitate access for applications running on boa
CVE-2025-12285 CRITICAL 9.8 UPGRADE UPGRADE Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12364 CRITICAL 9.8 UPGRADE UPGRADE Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12424 CRITICAL 9.8 UPGRADE UPGRADE Privilege Escalation through SUID-bit Binary.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19
CVE-2025-12476 CRITICAL 9.8 UPGRADE UPGRADE Resource Lacking AuthN.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVE-2025-12477 CRITICAL 9.8 UPGRADE UPGRADE Server Version Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVE-2025-12552 CRITICAL 9.8 UPGRADE UPGRADE Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12478 CRITICAL 9.8 UPGRADE UPGRADE Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVE-2025-12217 CRITICAL 9.1 UPGRADE UPGRADE SNMP Default Community String (public).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12218 CRITICAL 9.1 UPGRADE UPGRADE Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12553 CRITICAL 9.8 UPGRADE UPGRADE Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.
CVE-2025-12423 HIGH 7.5 UPGRADE UPGRADE Protocol manipulation might lead to denial of service.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: thr
CVE-2025-12363 HIGH 7.5 UPGRADE UPGRADE Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12221 HIGH 8.8 UPGRADE UPGRADE Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1
CVE-2025-12479 HIGH 8.8 UPGRADE UPGRADE Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation.This issue affects BLU-IC2: through 1.
CVE-2025-12278 MEDIUM 6.5 UPGRADE UPGRADE Logout Functionality not Working.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12425 HIGH 7.8 UPGRADE UPGRADE Local Privilege Escalation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVE-2025-12365 MEDIUM 5.3 UPGRADE UPGRADE Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-11925 MEDIUM 6.1 UPGRADE UPGRADE Incorrect Content-Type header in one of the APIs (`text/html` instead of `application/json`) replies may poten
CVE-2025-12031 MEDIUM 5.3 UPGRADE UPGRADE HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute may allow reading the sensitive cookies
CVE-2025-12284 MEDIUM 6.1 UPGRADE UPGRADE Lack of Input Validation in the web UI might lead to potential exploitation.This issue affects BLU-IC2: throug
CVE-2025-12001 MEDIUM 6.1 UPGRADE UPGRADE Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: through
CVE-2025-12216 MEDIUM 5.5 UPGRADE UPGRADE Malicious / Malformed App can be Installed but not Uninstalled/may lead to unavailability.This issue affects B
CVE-2025-12114 MEDIUM 5.5 UPGRADE UPGRADE Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.Thi
CVE-2025-12515 CRITICAL 9.8 UPGRADE UPGRADE Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: throug
CVE-2025-12516 CRITICAL 9.8 UPGRADE UPGRADE Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1
CVE-2025-12517 MEDIUM 5.3 UPGRADE UPGRADE Credits Page not Matching Versions in Use in the FirmwareThis issue affects BLU-IC2: through 1.19.5; BLU-IC4:

FAQ

How do I fix azure-access vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is azure-access being exploited right now?

None of the tracked azure-access CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which azure-access CVE should I patch first?

CVE-2025-12275 currently ranks highest (51/100): Mail Configuration File Manipulation + Command Execution.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: .

Products

RSS feed for azure-access · ← Back to latest CVEs