CVE-2025-65396 describes a vulnerability in the boot process of Blurams Flare Camera firmware version 24.1114.151.929 and earlier. An attacker with physical proximity can short a data pin on the SPI flash memory IC to ground during boot, causing a read error. This triggers the device to enter a bootloader shell accessible via the UART interface. Through this shell, the attacker can dump the full firmware, leading to disclosure of sensitive data including cryptographic keys and user configurations. The vulnerability involves improper handling of SPI flash read errors and insufficient bootloader access controls.

Successful exploitation allows an attacker with physical access to bypass normal boot security, gain a bootloader shell, and extract the entire firmware image. This results in disclosure of sensitive information such as cryptographic keys and user configuration data, potentially enabling further attacks or device compromise. There is no indication of denial of service or remote exploitation. The impact is confidentiality loss with no reported integrity or availability impact.

No official patch or fix is currently available for this vulnerability. Users should restrict physical access to affected devices to prevent exploitation. Monitor vendor advisories for updates or firmware patches addressing this issue. Since this is a hardware-level boot process vulnerability requiring physical proximity and hardware manipulation, mitigation primarily involves physical security controls until a software or hardware fix is released.