CVE-2025-12176 - Vulnerability Details - OpenCVE

Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://azure-access.com/security-advisories

History

Fri, 24 Oct 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 24 Oct 2025 16:15:00 +0000

Type	Values Removed	Values Added
Description		Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Title		Undocumented Administrative Accounts
Weaknesses		CWE-1242
References		https://azure-access.com/security-advisories
Metrics		cvssV4_0 `{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`

MITRE

Status: PUBLISHED

Assigner: azure-access

Published: 2025-10-24T15:56:07.959Z

Updated: 2025-10-24T19:56:09.959Z

Reserved: 2025-10-24T15:51:46.644Z

Link: CVE-2025-12176

Vulnrichment

Updated: 2025-10-24T19:56:03.715Z

NVD

Status : Received

Published: 2025-10-24T16:15:36.617

Modified: 2025-10-24T16:15:36.617

Link: CVE-2025-12176

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-12176", "assignerOrgId": "a0340c66-c385-4f8b-991b-3d05f6fd5220", "state": "PUBLISHED", "assignerShortName": "azure-access", "dateReserved": "2025-10-24T15:51:46.644Z", "datePublished": "2025-10-24T15:56:07.959Z", "dateUpdated": "2025-10-24T19:56:09.959Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "BLU-IC2", "vendor": "Azure Access Technology", "versions": [{"lessThanOrEqual": "1.19.5", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "BLU-IC4", "vendor": "Azure Access Technology", "versions": [{"lessThanOrEqual": "1.19.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Kevin Schaller"}, {"lang": "en", "type": "finder", "value": "Benjamin Lafois"}, {"lang": "en", "type": "finder", "value": "Alexi Bitsios"}, {"lang": "en", "type": "finder", "value": "Sebastian Toscano"}, {"lang": "en", "type": "finder", "value": "Dominik Schneider"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Undocumented administrative accounts were getting created to facilitate access for applications running on board.<p>This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.</p>"}], "value": "Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5."}], "impacts": [{"capecId": "CAPEC-36", "descriptions": [{"lang": "en", "value": "CAPEC-36 Using Unpublished Interfaces or Functionality"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1242", "description": "CWE-1242: Inclusion of Undocumented Features or Chicken Bits", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a0340c66-c385-4f8b-991b-3d05f6fd5220", "shortName": "azure-access", "dateUpdated": "2025-10-24T15:56:07.959Z"}, "references": [{"url": "https://azure-access.com/security-advisories"}], "source": {"discovery": "UNKNOWN"}, "title": "Undocumented Administrative Accounts", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-24T16:41:48.448092Z", "id": "CVE-2025-12176", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-24T19:56:09.959Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12176", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-24T16:41:48.448092Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-24T19:56:03.715Z"}}], "cna": {"title": "Undocumented Administrative Accounts", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Kevin Schaller"}, {"lang": "en", "type": "finder", "value": "Benjamin Lafois"}, {"lang": "en", "type": "finder", "value": "Alexi Bitsios"}, {"lang": "en", "type": "finder", "value": "Sebastian Toscano"}, {"lang": "en", "type": "finder", "value": "Dominik Schneider"}], "impacts": [{"capecId": "CAPEC-36", "descriptions": [{"lang": "en", "value": "CAPEC-36 Using Unpublished Interfaces or Functionality"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Azure Access Technology", "product": "BLU-IC2", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.19.5"}], "defaultStatus": "unaffected"}, {"vendor": "Azure Access Technology", "product": "BLU-IC4", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.19.5"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://azure-access.com/security-advisories"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.", "supportingMedia": [{"type": "text/html", "value": "Undocumented administrative accounts were getting created to facilitate access for applications running on board.<p>This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1242", "description": "CWE-1242: Inclusion of Undocumented Features or Chicken Bits"}]}], "providerMetadata": {"orgId": "a0340c66-c385-4f8b-991b-3d05f6fd5220", "shortName": "azure-access", "dateUpdated": "2025-10-24T15:56:07.959Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12176", "state": "PUBLISHED", "dateUpdated": "2025-10-24T19:56:09.959Z", "dateReserved": "2025-10-24T15:51:46.644Z", "assignerOrgId": "a0340c66-c385-4f8b-991b-3d05f6fd5220", "datePublished": "2025-10-24T15:56:07.959Z", "assignerShortName": "azure-access"}, "dataVersion": "5.1"}