CVE-2025-63296

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-63296
KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boot/update logic: during startup /usr/sbin/anyka_service.sh scans mounted TF/SD cards and, if /mnt/update.nor.sh is present, copies it to /tmp/net.sh and executes it as root.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gist.github.com/t4e-3/082cdd0b7ee6b650c7aaae97fd4e016c Exploit Third Party Advisory
https://github.com/t4e-3/CVE-2025-63296 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:keruistore:kerui_k259_firmware:33.53.87:*:*:*:*:*:*:*
cpe:2.3:h:keruistore:kerui_k259:-:*:*:*:*:*:*:*
History

05 Feb 2026, 15:15

Type Values Removed Values Added
References () https://gist.github.com/t4e-3/082cdd0b7ee6b650c7aaae97fd4e016c - () https://gist.github.com/t4e-3/082cdd0b7ee6b650c7aaae97fd4e016c - Exploit, Third Party Advisory
References () https://github.com/t4e-3/CVE-2025-63296 - () https://github.com/t4e-3/CVE-2025-63296 - Exploit, Third Party Advisory
Summary
  • (es) El firmware v33.53.87 de la cámara de seguridad inteligente KERUI K259 5MP Wi-Fi / Tuya contiene una vulnerabilidad de ejecución de código en su lógica de arranque/actualización: durante el arranque, /usr/sbin/anyka_service.sh escanea las tarjetas TF/SD montadas y, si /mnt/update.nor.sh está presente, lo copia a /tmp/net.sh y lo ejecuta como root.
First Time Keruistore kerui K259 Firmware
Keruistore
Keruistore kerui K259
CPE cpe:2.3:o:keruistore:kerui_k259_firmware:33.53.87:*:*:*:*:*:*:*
cpe:2.3:h:keruistore:kerui_k259:-:*:*:*:*:*:*:*

12 Nov 2025, 21:15

Type Values Removed Values Added
CWE CWE-77
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

10 Nov 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-11-10 21:15

Updated : 2026-02-05 15:15

NVD link : CVE-2025-63296

Mitre link : CVE-2025-63296

CVE.ORG link : CVE-2025-63296

JSON object : View

Products Affected

keruistore

  • kerui_k259_firmware
  • kerui_k259
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')