High · published October 27, 2025
🚨 A critical vulnerability in BLU-IC2 and BLU-IC4 could expose your email password, simply by accessing the right endpoint! 🔥 Imagine your email password is a secret recipe, and this vulnerability is a delivery driver who accidentally leaves your recipe book on the doorstep for anyone to grab. Any curious neighbor could just waltz in and snag a copy! This bug could lead to devastating consequences, allowing attackers to hijack email accounts or gain access to sensitive information. With passwords in hand, they could impersonate users, wreaking havoc on personal and organizational communications.
Imagine your email password is a secret recipe, and this vulnerability is a delivery driver who accidentally leaves your recipe book on the doorstep for anyone to grab. Any curious neighbor could just waltz in and snag a copy! CVE-2025-12363 allows unauthorized access to email passwords stored insecurely in BLU-IC2 and BLU-IC4 versions up to 1.19.5, exposing them through certain endpoints without proper authentication checks.
This bug could lead to devastating consequences, allowing attackers to hijack email accounts or gain access to sensitive information. With passwords in hand, they could impersonate users, wreaking havoc on personal and organizational communications. Immediate action is essential! Update both BLU-IC2 and BLU-IC4 to version 1.19.6 or later to patch this vulnerability. Additionally, ensure that all user passwords are stored securely, applying best practices for encryption and access controls. You've got this! With these steps, you'll not only secure your system but also elevate your security hero status! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| azure-access/blu-ic2_firmware | < 1.20 | 1.20 |
| azure-access/blu-ic4_firmware | < 1.20 | 1.20 |