CVE WatchJul 5, 2026

CVE-2025-65396

A vulnerability in the boot process of Blurams Flare Camera version 24.1114.151.929 and earlier allows a physically proximate attacker to hi

CVSS

6.1

Medium

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: Jan 14, 2026 · Last modified: Jul 5, 2026 · CWE-119 · CWE-125 · CWE-1274

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-06-302026-07-17

Technical description

A vulnerability in the boot process of Blurams Flare Camera version 24.1114.151.929 and earlier allows a physically proximate attacker to hijack the boot mechanism and gain a bootloader shell via the UART interface. This is achieved by inducing a read error from the SPI flash memory during the boot, by shorting a data pin of the IC to ground. An attacker can then dump the entire firmware, leading to the disclosure of sensitive information including cryptographic keys and user configurations.

Official references

lessonsec.comhttps://lessonsec.com/cve/cve-2025-65396/

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-312778.8 HIG

71.0%

KEV—71Apple Multiple Products Buffer Overflow Vulnerability3d CVE-2005-445910.0 NO

96.2%

——29Heap-based buffer overflow in the NAT networking components vmnat.exe and vmnet-natd in VMWare Workstation 5.5, GSX Server 3.2, ACE 1.0.1, and Player 1.0 allows remote authenticated attackers, including guests, to execute arbitrary code via crafted (1) EPRT and (2) PORT FTP commands.10d CVE-2026-48915.3 MED

92.7%

——28A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.3d CVE-2011-40454.3 NO

88.5%

——27Buffer overflow in an unspecified ActiveX control in aipgctl.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to cause a denial of service via a crafted HTML document.8d CVE-2022-274067.5 HIG

87.5%

——26FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size.9d CVE-2022-274057.5 HIG

85.0%

——25FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.9d