An insecure authentication mechanism in the safe_exec.sh startup script of Blurams Flare Camera version 24.1114.151.929 and earlier allows an attacker with physical access to the device to execute arbitrary commands with root privileges, if file /opt/images/public_key.der is not present in the file system. The vulnerability can be triggered by providing a maliciously crafted auth.ini file on the device's SD card.
References
| Link | Resource |
|---|---|
| http://blurams.com | Product |
| http://flare.com | Broken Link |
| https://lessonsec.com/cve/cve-2025-65397/ | Broken Link |
Configurations
Configuration 1 (hide)
| AND |
|
History
03 Feb 2026, 18:32
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:blurams:dome_flare_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:blurams:dome_flare:-:*:*:*:*:*:*:* |
|
| References | () http://blurams.com - Product | |
| References | () http://flare.com - Broken Link | |
| References | () https://lessonsec.com/cve/cve-2025-65397/ - Broken Link | |
| First Time |
Blurams dome Flare Firmware
Blurams dome Flare Blurams |
21 Jan 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.8 |
14 Jan 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-20 CWE-287 |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.4 |
14 Jan 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-14 18:16
Updated : 2026-02-03 18:32
NVD link : CVE-2025-65397
Mitre link : CVE-2025-65397
CVE.ORG link : CVE-2025-65397
JSON object : View
Products Affected
blurams
- dome_flare
- dome_flare_firmware