Executive brief
A vulnerability in the Blurams Lumi Security Camera (A31C) allows an individual with physical access to the device to take full control of it. By placing a specially crafted file on an SD card and inserting it into the camera, an attacker can bypass security checks during the startup process. This allows for the execution of unauthorized code, which could lead to the theft of video data, disabling of the camera, or use of the device as a foothold in a local network.
Technical details
A vulnerability exists in the U-Boot auto-update mechanism of the Blurams Lumi Security Camera (A31C) firmware version 23.1227.472.2926. The device's bootloader automatically searches for a specific encrypted update file (f1r03_SD_UPDATA.enc) on an inserted SD card during the boot process. While the update process employs XOR-based obfuscation and CRC16 checksums to verify integrity, these mechanisms are insufficient to prevent a physical attacker from reverse-engineering the routine and crafting a malicious update. By overriding the bootloader or system files via this SD card update path, an attacker with physical access can achieve arbitrary code execution with high privileges.
Affected products
- Blurams Lumi Security Camera (A31C) 23.1227.472.2926
Timeline
- 2025-11-13: other: Vulnerability research published by Vindiv Labs
- 2025-11-24: advisory: CVE-2025-63674 published