Executive brief
A security vulnerability in Blurams Flare smart cameras allows an individual with physical access to the device to take full control of the system. By placing a specifically crafted file on the camera's SD card, an attacker can bypass security checks and run unauthorized commands. This could lead to the complete compromise of the device, including unauthorized access to video feeds or the disabling of security features.
Technical details
An improper authentication vulnerability exists in the 'safe_exec.sh' startup script of Blurams Flare Cameras. The script fails to properly validate the 'auth.ini' file located on an inserted SD card when a specific system file (/opt/images/public_key.der) is missing. An attacker with physical access can exploit this by inserting an SD card containing a maliciously crafted 'auth.ini' file to achieve arbitrary command execution with root privileges. The issue is addressed in firmware version 25.1119.177.2341.
Affected products
- Blurams Flare Camera <= 24.1114.151.929
Timeline
- 2025-09-23: other: First contacted vendor
- 2025-10-08: other: Vulnerability report submitted to vendor
- 2025-10-11: other: Vulnerabilities confirmed by vendor
- 2026-01-14: disclosed: Public disclosure
- 2026-01-14: patched: Patch available in version 25.1119.177.2341