Critical · published October 26, 2025
🚨 A missing initial password change in BLU-IC2 and BLU-IC4 versions through 1.19.5 leaves the door wide open for attackers! 🔥 This is like moving into a new apartment but never changing the locks — anyone can walk in with the previous owner's key. Without a mandatory password change, any unauthorized user could easily gain access to sensitive information. An attacker could exploit this vulnerability to access the system and control it as if they were the legitimate user. This means they could read, modify, or even delete sensitive data, leading to potentially devastating consequences for your organization.
This is like moving into a new apartment but never changing the locks — anyone can walk in with the previous owner's key. Without a mandatory password change, any unauthorized user could easily gain access to sensitive information. This vulnerability allows unauthorized access due to the system not enforcing a mandatory password change upon first login, leaving it susceptible to anyone who may know the default credentials, if they exist.
An attacker could exploit this vulnerability to access the system and control it as if they were the legitimate user. This means they could read, modify, or even delete sensitive data, leading to potentially devastating consequences for your organization. Immediate action is required: update to the latest patched version of BLU-IC2 or BLU-IC4 to secure your system. Additionally, enforce a policy that requires users to change their passwords upon first login to prevent unauthorized access. You've got this! Follow these steps, and you'll be well on your way to locking down your system. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| azure-access/blu-ic2_firmware | < 1.20 | 1.20 |
| azure-access/blu-ic4_firmware | < 1.20 | 1.20 |