CVE-2025-12001CWE-20CWE-79cross-site-scripting

CVE-2025-12001

Medium · published October 21, 2025

CVSS v3.1

6.1

EPSS

Percentile

8.6

In the wild

Unconfirmed

What it is

Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

The record

Technical detail

CVSS v3.1: 6.1 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00194 · 8.6th percentile
Weaknesses: CWE-20 · Improper Input Validation; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2025-10-21T02:15Z

Affected products (2)

Product	Versions	Fixed in
azure-access/blu-ic2_firmware	< 1.20	1.20
azure-access/blu-ic4_firmware	< 1.20	1.20

References (1)

EPSS history

Timeline