Email Server Vulnerability in BLU-IC2 and BLU-IC4 Products by BLU
CVE-2025-12553

10CRITICAL

Key Information:

Vendor

Azure Access Technology

Status
Blu-ic2
Blu-ic4
Vendor
CVE Published:
31 October 2025

What is CVE-2025-12553?

A significant security issue has been identified in the BLU-IC2 and BLU-IC4 products that pertains to the disabled certificate verification for email servers. This flaw could potentially lead to unauthorized access and man-in-the-middle attacks, compromising the integrity and confidentiality of email communications. Users are encouraged to update their products to secure their email server configurations and ensure robust certificate verification processes are enforced.

Affected Version(s)

BLU-IC2 0 <= 1.19.5

BLU-IC4 0 <= 1.19.5

References

https://azure-access.com/security-advisories

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kevin Schaller
Benjamin Lafois
Alexi Bitsios
Sebastian Toscano
Dominik Schneider
JSON
.
CVE-2025-12553 : Email Server Vulnerability in BLU-IC2 and BLU-IC4 Products by BLU