Critical · published November 1, 2025
🚨 Multiple devices are sharing the same secrets, putting your entire system at risk! This CVE-2025-12599 is a ticking time bomb that affects BLU-IC2 and BLU-IC4 up to version 1.19.5. 🔥 Think of it like a group of friends sharing the same house key without realizing anyone could walk in uninvited. If one of them loses their key, everyone’s safety is compromised! An attacker could potentially access any device sharing these secrets, leading to unauthorized data exposure or manipulation. This isn't just a minor inconvenience; it could fully compromise your network integrity and expose sensitive information!
Think of it like a group of friends sharing the same house key without realizing anyone could walk in uninvited. If one of them loses their key, everyone’s safety is compromised! This vulnerability arises because multiple devices are using the same shared secrets for SDKSocket communication, making them susceptible to unauthorized access and control through TCP on port 5000.
An attacker could potentially access any device sharing these secrets, leading to unauthorized data exposure or manipulation. This isn't just a minor inconvenience; it could fully compromise your network integrity and expose sensitive information! Update all affected devices to version 1.19.6 or later immediately. Consider setting unique secrets for each device to enhance security and reduce the risk of a mass exploitation. You’ve got this! Implement these changes and strengthen your defenses today! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| azure-access/blu-ic2_firmware | < 1.20 | 1.20 |
| azure-access/blu-ic4_firmware | < 1.20 | 1.20 |