Critical · published November 1, 2025
⚠️ An arbitrary write vulnerability lurks in the Avahi service configuration! This one could be a cute surprise or a pesky problem, depending on how it's used! 🔧 Think of it like someone sneaking into a restaurant and swapping the menus. If they change the dishes, unsuspecting diners might order something that was never intended to be served! In this case, an attacker could potentially manipulate the service settings, leading to unwanted behavior or configurations. While it's a low severity risk, it could still cause confusion and operational issues if not addressed!
Think of it like someone sneaking into a restaurant and swapping the menus. If they change the dishes, unsuspecting diners might order something that was never intended to be served! This vulnerability allows arbitrary writing to the /etc/avahi/services/z9.service file, affecting BLU-IC2 and BLU-IC4 versions up to 1.19.5. This means a user could change the service definitions without proper authorization, leading to unexpected service behavior.
In this case, an attacker could potentially manipulate the service settings, leading to unwanted behavior or configurations. While it's a low severity risk, it could still cause confusion and operational issues if not addressed! To mitigate this issue, update your BLU-IC2 and BLU-IC4 to versions beyond 1.19.5. Additionally, review the service file permissions to ensure only authorized users can make changes. Regular audits can also help catch such configurations before they lead to trouble! You've got this! With a quick update and some permissions tweaking, you'll be back in control! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| azure-access/blu-ic2_firmware | < 1.20 | 1.20 |
| azure-access/blu-ic4_firmware | < 1.20 | 1.20 |