Critical · published October 26, 2025
🚨 A crafty configuration issue in BLU-IC2 and BLU-IC4 lets attackers execute commands just by manipulating mail settings! 🔥 Think of it like a restaurant where the chef is blindly following a recipe from a suspicious customer, leading to unexpected and potentially disastrous dishes. In this case, the server is executing commands based on unvalidated email configurations. An attacker could exploit this vulnerability to gain complete control over the system, executing arbitrary commands and potentially compromising sensitive data. This could lead to catastrophic breaches, loss of data integrity, and a complete takeover of your network.
Think of it like a restaurant where the chef is blindly following a recipe from a suspicious customer, leading to unexpected and potentially disastrous dishes. In this case, the server is executing commands based on unvalidated email configurations. This vulnerability allows unauthorized users to manipulate the mail configuration file, leading to remote command execution on affected versions of BLU-IC2 and BLU-IC4 (up to 1.19.5).
An attacker could exploit this vulnerability to gain complete control over the system, executing arbitrary commands and potentially compromising sensitive data. This could lead to catastrophic breaches, loss of data integrity, and a complete takeover of your network. To protect your systems, patch BLU-IC2 and BLU-IC4 to version 1.19.6 or later immediately. Additionally, review your mail configuration settings and restrict access to only trusted entities. You've got this! With these steps, you'll be back on track to becoming a security hero in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| azure-access/blu-ic2_firmware | < 1.20 | 1.20 |
| azure-access/blu-ic4_firmware | < 1.20 | 1.20 |