CVE-2023-50488

The vulnerability classified as CWE-94 (code injection) allows an attacker to inject and execute arbitrary code on the vulnerable device. The attack can be conducted remotely over the network without requiring privileges or user interaction. Publicly available PoC (proof-of-concept) code confirms the feasibility of practical exploitation of the vulnerability.

An attacker can take full control of the device, gaining access to the camera's video and audio streams, and potentially using it as an entry point to the local network. Loss of confidentiality, integrity, and availability of the system is possible.

Patches available from the manufacturer should be applied according to the references. Until an update is applied, it is recommended to isolate the device from the public network and restrict access to it only from trusted local network segments.

Blurams Lumi Security Camera A31C with firmware version v23.0406.435.4120