CVE-2025-65397
📋 TL;DR
This vulnerability allows attackers with physical access to Blurams Flare Camera devices to execute arbitrary commands with root privileges by placing a malicious auth.ini file on the device's SD card. The exploit works when the /opt/images/public_key.der file is missing from the system. This affects Blurams Flare Camera users with vulnerable firmware versions.
💻 Affected Systems
- Blurams Flare Camera
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing installation of persistent malware, camera control takeover, network pivoting, and data exfiltration.
Likely Case
Local attacker gains root access to modify camera settings, disable security features, or install surveillance malware.
If Mitigated
Limited impact if physical access controls prevent unauthorized SD card insertion and file system monitoring detects auth.ini modifications.
🎯 Exploit Status
Exploitation requires physical access to insert SD card with malicious auth.ini file. No authentication bypass needed beyond physical access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://blurams.com
Restart Required: No
Instructions:
1. Check Blurams website for firmware updates. 2. Update camera firmware if available. 3. Ensure /opt/images/public_key.der exists on device.
🔧 Temporary Workarounds
Ensure public_key.der exists
linuxCreate or verify the existence of /opt/images/public_key.der file to prevent exploitation
touch /opt/images/public_key.der
chmod 644 /opt/images/public_key.der
Disable SD card functionality
allRemove or disable SD card slot to prevent malicious file insertion
🧯 If You Can't Patch
- Restrict physical access to cameras and secure areas
- Monitor for unauthorized SD card insertion and file system changes
🔍 How to Verify
Check if Vulnerable:
Check if /opt/images/public_key.der file exists: ls -la /opt/images/public_key.derCheck Version:
Check device firmware version in camera settings or via manufacturer appVerify Fix Applied:
Verify file exists and check firmware version against patched version📡 Detection & Monitoring
Log Indicators:
- Unexpected SD card insertion events
- File system modifications to /opt/images/
- Execution of safe_exec.sh with unusual parameters
Network Indicators:
- Unusual outbound connections from camera
- Unexpected firmware update attempts
SIEM Query:
source="camera_logs" AND (event="sd_card_inserted" OR file_path="/opt/images/auth.ini")