CVE-2025-65396

A vulnerability in the boot process of Blurams Flare Camera version 24.1114.151.929 and earlier allows a physically proximate attacker to hijack the boot mechanism and gain a bootloader shell via the UART interface. This is achieved by inducing a read error from the SPI flash memory during the boot, by shorting a data pin of the IC to ground. An attacker can then dump the entire firmware, leading to the disclosure of sensitive information including cryptographic keys and user configurations.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.2

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lessonsec.com/cve/cve-2025-65396/	Broken Link

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:blurams:dome_flare_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:blurams:dome_flare:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-01-14 17:16

Updated : 2026-07-05 17:17

NVD link : CVE-2025-65396

Mitre link : CVE-2025-65396

CVE.ORG link : CVE-2025-65396

JSON object : View

Products Affected

blurams

dome_flare
dome_flare_firmware

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-125

Out-of-bounds Read

CWE-1274

Improper Access Control for Volatile Memory Containing Boot Code

{"id": "CVE-2025-65396", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65396", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-14T19:24:47.130488Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-01-14T17:16:06.810", "references": [{"url": "https://lessonsec.com/cve/cve-2025-65396/", "tags": ["Broken Link"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-1274"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the boot process of Blurams Flare Camera version 24.1114.151.929 and earlier allows a physically proximate attacker to hijack the boot mechanism and gain a bootloader shell via the UART interface. This is achieved by inducing a read error from the SPI flash memory during the boot, by shorting a data pin of the IC to ground. An attacker can then dump the entire firmware, leading to the disclosure of sensitive information including cryptographic keys and user configurations."}, {"lang": "es", "value": "Una vulnerabilidad en el proceso de arranque de la c\u00e1mara Blurams Flare versi\u00f3n 24.1114.151.929 y anteriores permite a un atacante con proximidad f\u00edsica secuestrar el mecanismo de arranque y obtener un shell del bootloader a trav\u00e9s de la interfaz UART. Esto se logra al inducir un error de lectura de la memoria flash SPI durante el arranque, al cortocircuitar un pin de datos del CI a tierra. Un atacante puede entonces volcar el firmware completo, lo que lleva a la divulgaci\u00f3n de informaci\u00f3n sensible, incluyendo claves criptogr\u00e1ficas y configuraciones de usuario."}], "lastModified": "2026-07-05T17:17:22.703", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:blurams:dome_flare_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7DF75DE9-F147-44E6-9DBC-567B852365B2", "versionEndIncluding": "24.1114.151.929"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:blurams:dome_flare:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D5924B6A-3F95-490D-B119-0ECF8D988F3A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}