PT-2026-2920 · Blurams · Blurams Flare Camera

Published 2026-01-14 · Updated 2026-01-15 · CVE-2025-65397

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Blurams Flare Camera versions prior to 24.1114.151.929

Description An insecure authentication mechanism exists in the safe exec.sh startup script. This allows an attacker with physical access to the device to execute arbitrary commands with root privileges. The issue is triggered by providing a maliciously crafted auth.ini file on the device's SD card, specifically when the file /opt/images/public key.der is not present in the file system.

Recommendations Ensure the file /opt/images/public key.der is present in the file system.

Fix

Improper Authentication

RCE

Weakness Enumeration

CWE-287

CWE-20

Related Identifiers

CVE-2025-65397

Affected Products

Blurams Flare Camera

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-65397 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65397 · Vendor Advisory
• https://twitter.com/CVEnew/status/2011759599838175254 · Twitter Post
• https://twitter.com/TheHackerWire/status/2011541710820818980 · Twitter Post
• https://lessonsec.com/cve/cve-2025-65397 · Note
• http://flare.com · Note
• http://blurams.com · Note