Blurams Lumi Security Camera Bootloader Override Vulnerability Allowing Arbitrary Code Execution

A vulnerability in the Blurams Lumi Security Camera model A31C, specifically in version 23.1227.472.2926, allows local physical attackers to execute arbitrary code by overriding the bootloader on the SD card. This is achieved through a reverse-engineered update mechanism that can be exploited by inserting a modified SD card and power cycling the device.

Impact

Exploitation of this vulnerability leads to unauthorized arbitrary code execution on the device with root privileges.

Reproduction

The vulnerability can be reproduced by inserting an SD card programmed with a specific payload that exploits the camera's update mechanism. After inserting the SD card, the device must be power cycled, which triggers the bootloader to read the modified update file from the SD card. The injected code is then executed, resulting in a root shell on the device.