CVE-2025-47819

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interface with improper access control.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1191

Affected software

Vendor	Product	Versions
Flock Safety	Gunshot Detection devices	< 1.3

References

https://gainsec.com/2025/06/19/bird-hunting-season-security-research-on-flock-safety-anti-crime-systems/Third Party Advisory
https://gainsec.com/2025/06/19/plucked-and-rooted-device-1-debug-shell-on-flock-safetys-raven-gunshot-detection-system/Third Party Advisory
https://gainsec.com/wp-content/uploads/2025/06/flock-safety-researcher-summary.pdfThird Party Advisory
https://www.flocksafety.com/articles/gunshot-detection-and-license-plate-reader-security-alertVendor Advisory

Timeline

Published: Jun 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-47828.8A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. This vulnerability affect CVE-2025-478202.4Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code.CVE-2025-478214.6Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system.CVE-2025-478226.8Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have an on-chip debug interface with improper access control.CVE-2025-478234.6Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.CVE-2025-478242.4Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code.CVE-2025-478274.6In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultima CVE-2025-478286.4Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.CVE-2025-47835.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of the Countdow CVE-2025-47849.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Moderec Tourtella allows SQL Injection CVE-2025-478498.8A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in t CVE-2025-47859.8A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. Affected by this issue is some unkn