CVE-2025-47823

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-259

Affected software

Vendor	Product	Versions
Flock Safety	License Plate Reader	<= 2.2

References

https://gainsec.com/2025/06/19/bird-hunting-season-security-research-on-flock-safety-anti-crime-systems/Third Party Advisory
https://gainsec.com/2025/06/19/grounded-flight-device-2-root-shell-on-flock-safetys-falcon-sparrow-automated-license-plate-reader/Third Party Advisory
https://gainsec.com/wp-content/uploads/2025/06/flock-safety-researcher-summary.pdfTechnical Description, Third Party Advisory
https://www.flocksafety.com/articles/gunshot-detection-and-license-plate-reader-security-alertVendor Advisory

Timeline

Published: Jun 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-478242.4Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code.CVE-2025-478274.6In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultima CVE-2025-478286.4Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.CVE-2025-47835.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of the Countdow CVE-2025-47849.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Moderec Tourtella allows SQL Injection CVE-2025-478498.8A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in t CVE-2025-47859.8A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. Affected by this issue is some unkn CVE-2025-478505.3In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning CVE-2025-478515.4In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible CVE-2025-478525.4In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible CVE-2025-478535.4In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible CVE-2025-478546.1In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page