CVE-2023-50488 is a critical arbitrary code execution flaw in the Blurams Lumi Security Camera A31C, scored 9.8 by NVD. It affects firmware up to and including 23.0406.435.4120. The researchers report the vendor fixed it in later firmware, so update the camera to the newest release available.
What's affected
The NVD record names the Blurams Lumi Security Camera (A31C) firmware 23.0406.435.4120. The researcher write up says the problem "potentially affects all devices up to and including firmware version 23.0406.435.4120", so older builds should be treated the same way.
Here the sources disagree on how the flaw is reached. NVD scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which means network reachable with no privileges. The researchers describe a factory test script that runs when an SD card is inserted, which points to physical access to the SD card slot. Both are worth knowing. The 9.8 score is what scanners and questionnaires will show, while the write up describes a narrower real world condition.
The record gives a published date of 2024-02-02. The researchers say they reported the issue to the vendor, that a fix followed, and that all reported problems were fixed by public disclosure on 2024-02-01. They also describe a separate SD card issue in replacement firmware, tracked as CVE-2023-51820, that needed a further fix. The write up does not give a single fixed version number for this CVE, so check the firmware version in the Blurams app against the vendor's latest.
How to check if you're exposed
Open the Blurams app, find the camera in its device settings and read the firmware version. If it is 23.0406.435.4120 or older, it is affected. If the app offers a newer firmware, install it.
For fleets, list every Lumi A31C you have deployed, including cameras in offices and warehouses that nobody remembers adding. A consumer style camera on a business network is an asset that rarely appears in a vulnerability scanner, so an inventory by hand or from your network records is often the only way to find them.
Check physical placement as well. If the cause is reachable through the SD card slot, a camera mounted where anyone can touch it carries more risk than one in a locked room.
What to do now
- Identify every Blurams Lumi A31C camera and its firmware version.
- Update each camera to the newest firmware the vendor offers through the app.
- Place cameras on a separate network segment with no route to business systems.
- Where possible, mount cameras so the SD card slot is not reachable by visitors, or remove the card.
- Treat a camera that cannot be updated as end of life and plan to replace it.
Why it matters
The record classifies the weakness as code injection, CWE-94. In this case the researchers trace it to a test script gated by a key derived only from the publicly known software version string. Anyone who can work out that value can satisfy the check, so the gate offers no protection.
This is a common pattern in embedded devices. Factory and debug functions are left in shipping firmware, protected by a secret that is really a formula. Once the formula is known, every unit of that firmware is open in the same way.
The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog according to the record, and the sources fetched do not report use in the wild.
Quick check
Is the 9.8 score accurate for a physical access flaw?
NVD scores it as network reachable with no privileges. The researcher write up describes an SD card trigger, which suggests physical access. Treat the score as the worst case and the write up as the likely path.
Which firmware fixes it?
The sources do not give a single version number for this CVE. Install the latest firmware the vendor offers and confirm in the app.
Sources
Last reviewed: 19 October 2026.
