Critical · published October 24, 2025
🚨 Undocumented admin accounts are popping up like mushrooms after rain! This is a serious oversight in BLU-IC2 and BLU-IC4 up to version 1.19.5. 🔥 Think of this as a hidden door in a secure building—nobody remembered to lock it, and now anyone with a bit of know-how can stroll right in without a key! It’s a major breach in your defenses. An attacker could exploit these undocumented accounts to gain full administrative access, allowing them to manipulate settings, steal sensitive data, and potentially deploy malicious applications. The consequences could be absolutely devastating for your entire network!
Think of this as a hidden door in a secure building—nobody remembered to lock it, and now anyone with a bit of know-how can stroll right in without a key! It’s a major breach in your defenses. This vulnerability allows the creation of hidden administrative accounts that can be used for unauthorized access by applications, affecting BLU-IC2 and BLU-IC4 up to version 1.19.5. Essentially, a backdoor is created without any authentication or monitoring in place.
An attacker could exploit these undocumented accounts to gain full administrative access, allowing them to manipulate settings, steal sensitive data, and potentially deploy malicious applications. The consequences could be absolutely devastating for your entire network! Immediate action is required: upgrade your systems to versions that patch this issue, and thoroughly audit your existing user accounts to remove any unauthorized access. Enable monitoring on user account creation to prevent this from happening again! You’ve got this! With these steps, you’ll be reinforcing your security fortress in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| azure-access/blu-ic2_firmware | < 1.20 | 1.20 |
| azure-access/blu-ic4_firmware | < 1.20 | 1.20 |