Critical · published October 28, 2025
🔥 A mere upgrade command can let an attacker write files anywhere on the system! This flaw in the upgrade feature could hand superuser permissions on a silver platter! Imagine a hotel that lets anyone walk in and claim an upgrade just by asking — no verification necessary. An unwatched front desk means anyone could snag the penthouse suite without any guards! If exploited, an attacker could gain full control of your system, allowing them to read sensitive files, install malicious software, or even take down essential services. This poses a massive risk, as it could compromise not just individual machines but entire networks.
Imagine a hotel that lets anyone walk in and claim an upgrade just by asking — no verification necessary. An unwatched front desk means anyone could snag the penthouse suite without any guards! The vulnerability arises from an arbitrary file write flaw in the upgrade feature of BLU-IC2 and BLU-IC4, impacting versions up to 1.19.5. This means that the system does not properly validate write requests, enabling an attacker to overwrite critical files.
If exploited, an attacker could gain full control of your system, allowing them to read sensitive files, install malicious software, or even take down essential services. This poses a massive risk, as it could compromise not just individual machines but entire networks. To protect against this, urgently upgrade your systems to version 1.19.6 or later. Additionally, review your file permissions and access controls to ensure that only trusted users can initiate upgrades. Implement logging to monitor upgrade requests to catch any suspicious activity early. You've got this! Follow these steps, and you'll be well on your way to fortifying your defenses! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| azure-access/blu-ic2_firmware | < 1.20 | 1.20 |
| azure-access/blu-ic4_firmware | < 1.20 | 1.20 |