CVE-2025-12221
BaseFortify
Publication date: 2025-10-25
Last updated on: 2025-11-07
Assigner: azure-access
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| azure-access | blu-ic2_firmware | to 1.20 (exc) |
| azure-access | blu-ic2 | * |
| azure-access | blu-ic4_firmware | to 1.20 (exc) |
| azure-access | blu-ic4 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
| CWE-16 | Configuration |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-12221 refers to multiple known vulnerabilities affecting Busybox versions up to 1.31.1 and BLU-IC2 and BLU-IC4 versions through 1.19.5. The specific details of the vulnerabilities are not provided in the available resources, but it is recognized and tracked by Azure Access Technology as part of their security advisories. [1]
How can this vulnerability impact me? :
The impact of CVE-2025-12221 is not explicitly detailed in the provided resources. However, since it involves multiple known vulnerabilities in Busybox and related components, it could potentially allow attackers to exploit these weaknesses, possibly leading to unauthorized actions or system compromise depending on the context of use. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
There is no information available in the provided resources regarding the impact of CVE-2025-12221 on compliance with standards or regulations such as GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
Immediate steps to mitigate this vulnerability include applying patches provided by the vendor for affected versions of Busybox and following security guidelines for system setup as recommended by Azure Access Technology. Since Azure Access Technology tracks this CVE and provides security advisories, checking their website for available patches and mitigation instructions is advised. [1]