CVE-2025-12221CWE-352csrf

CVE-2025-12221

High · published October 25, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
5.5
In the wild
Unconfirmed
What it is

💡 Multiple vulnerabilities exist in Busybox 1.31.1, and that's not the kind of busy you want! Think of it like a café that has a few cracked coffee mugs on the shelf — while it might not ruin your entire experience, it's definitely not ideal for sipping your daily brew. These vulnerabilities could allow minor issues that don't create a full-blown disaster but are still worth addressing. While these vulnerabilities aren’t currently known to be exploited, ignoring them could lead to unexpected behavior or minor security pitfalls down the line. It's like ignoring a small leak in your roof that could grow if left unattended!

Put simply

Think of it like a café that has a few cracked coffee mugs on the shelf — while it might not ruin your entire experience, it's definitely not ideal for sipping your daily brew. These vulnerabilities could allow minor issues that don't create a full-blown disaster but are still worth addressing. This issue affects various versions of Busybox by exposing known vulnerabilities that could lead to operational hiccups. Specifically, it pertains to BLU-IC2 and BLU-IC4 versions through 1.19.5, allowing for potential weaknesses in system operations.

What to do

While these vulnerabilities aren’t currently known to be exploited, ignoring them could lead to unexpected behavior or minor security pitfalls down the line. It's like ignoring a small leak in your roof that could grow if left unattended! To secure your systems, upgrade to a newer version of Busybox that addresses these vulnerabilities. Regularly check for updates and apply them promptly to keep your environment safe. You've got this! Address these minor issues, and your security hero status will shine brighter than ever! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00166 · 5.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-10-25T20:15Z
Affected products (2)
ProductVersionsFixed in
azure-access/blu-ic2_firmware< 1.201.20
azure-access/blu-ic4_firmware< 1.201.20
References (1)
EPSS history
Timeline
  • 25 OCT 15:57Z
    CSRF Token not Properly Implemented
    cvelistv5