Flocksafety Flock Safety vulnerabilities

CVE-2025-59403 [CRITICAL] CWE-749 CVE-2025-59403: The Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for Andro The Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for Android lacks authentication. It is responsible for the camera feed on Falcon, Sparrow, and Bravo devices, but exposes administrative API endpoints on port 8080 without authentication. Endpoints include but are not limited to: /reboot, /logs, /crashpack,

CVE-2025-59407 [CRITICAL] CWE-321 CVE-2025-59407: The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) bundles a Java Keystore (flock_rye.bks) along with its hardcoded password (flockhibiki17) in its code. The keystore contains a private key.

CVE-2025-59405 [HIGH] CWE-200 CVE-2025-59405: The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (insta The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) contains a cleartext DataDog API key within in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover the OAuth secre

CVE-2025-59406 [MEDIUM] CWE-319 CVE-2025-59406: The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on F The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) has a cleartext Auth0 client secret in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover this OAuth secret without spec