PT-2026-2920 · Blurams · Blurams Flare Camera

Publicado 2026-01-14 · Atualizado 2026-01-15 · CVE-2025-65397

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Blurams Flare Camera versions prior to 24.1114.151.929

Description An insecure authentication mechanism exists in the safe exec.sh startup script. This allows an attacker with physical access to the device to execute arbitrary commands with root privileges. The issue is triggered by providing a maliciously crafted auth.ini file on the device's SD card, specifically when the file /opt/images/public key.der is not present in the file system.

Recommendations Ensure the file /opt/images/public key.der is present in the file system.

Correção

Improper Authentication

RCE

Enumeração de Fraquezas

CWE-287

CWE-20

Identificadores relacionados

CVE-2025-65397

Produtos afetados

Blurams Flare Camera

Referências · 7

• https://twitter.com/CVEnew/status/2011759599838175254 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-65397 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2011541710820818980 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-65397 · Aviso do Fabricante
• https://lessonsec.com/cve/cve-2025-65397 · Nota
• http://flare.com · Nota
• http://blurams.com · Nota