CVE-2025-12515CWE-394

CVE-2025-12515

Critical · published October 30, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
29.7
In the wild
Unconfirmed
What it is

🚨 A systemic HTTP 500 error has been lurking in your BLU-IC2 and BLU-IC4 systems like a hidden trapdoor! 🔥 Imagine a bustling restaurant where the kitchen suddenly shuts down without warning, refusing to serve any orders. This vulnerability is like that kitchen—when it trips, every request for information is met with a frustrating error instead of the delicious data you ordered! This vulnerability effectively paralyzes your system, causing every request to generate a 500 Internal Server Error. If left unaddressed, it could lead to extended downtime, impacting users and service availability, translating into a headache for both customers and admins alike!

Put simply

Imagine a bustling restaurant where the kitchen suddenly shuts down without warning, refusing to serve any orders. This vulnerability is like that kitchen—when it trips, every request for information is met with a frustrating error instead of the delicious data you ordered! The issue arises within BLU-IC2 and BLU-IC4 versions up to 1.19.5, causing internal server errors that prevent users from accessing services or data, ultimately crippling operations during peak times.

What to do

This vulnerability effectively paralyzes your system, causing every request to generate a 500 Internal Server Error. If left unaddressed, it could lead to extended downtime, impacting users and service availability, translating into a headache for both customers and admins alike! To address this critical vulnerability, upgrade both BLU-IC2 and BLU-IC4 to version 1.19.6 or later. Also, monitor server logs to identify any hidden issues that may still arise post-upgrade. Don't let internal errors ruin your service! You've got this! With the right update, you'll have your systems running smoothly again in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00369 · 29.7th percentile
Weakness
CWE-394 · Unexpected Status Code or Return Value
Published
2025-10-30T20:15Z
Affected products (2)
ProductVersionsFixed in
azure-access/blu-ic4_firmware< 1.201.20
azure-access/blu-ic2_firmware< 1.201.20
References (1)
EPSS history
Timeline
  • 30 OCT 15:38Z
    Systemic Internal Server Errors - HTTP 500 Response
    cvelistv5