CVE-2025-59407

CriticalCVSS 9.8/10Last modified Nov 5, 2026

Description

The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) bundles a Java Keystore (flock_rye.bks) along with its hardcoded password (flockhibiki17) in its code. The keystore contains a private key.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-321

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gainsec.com/2025/09/27/fly-by-device-2-the-falcon-sparrow-gated-wireless-rce-camera-feed-dos-information-disclosure-and-more/Exploit, Third Party Advisory
https://gainsec.com/wp-content/uploads/2025/09/Root-from-the-Coop-Device-3_-Root-Shell-on-Flock-Safetys-Bravo-Compute-Box-GainSec.pdfExploit, Third Party Advisory
https://www.flocksafety.com/productsProduct
https://www.flocksafety.com/products/license-plate-readersProduct

Timeline

Published: Oct 2, 2025
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-594087.3Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 ships with Secure Boot disabled. This allows an attacker to flash modif CVE-2025-594097.5Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck) stored in cleartex CVE-2025-59412.0Netskope is notified about a potential gap in its agent (NS Client) in which a malicious actor could trigger a memory leak by sending a craf CVE-2025-594103.7Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the code in the scheduler for downloa CVE-2025-594115.4CubeCart is an ecommerce software solution. Prior to version 6.5.11, the contact form’s Enquiry field accepts raw HTML and that HTML is incl CVE-2025-594125.4CubeCart is an ecommerce software solution. Prior to version 6.5.11, a vulnerability exists in the product reviews feature where user-suppli CVE-2025-594136.5CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows CVE-2025-594143.1Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's CVE-2025-594155.4Frappe Learning is a learning system that helps users structure their content. In versions 2.34.1 and below, there is a security vulnerabili CVE-2025-594167.2The Scratch Channel is a news website. If the user makes a fork, they can change the admins and make an article. Since the API uses a POST r CVE-2025-594176.1Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.129.4, there is a a cross-site scripting (XSS) vulner CVE-2025-594185.5BunnyPad is a note taking software. Prior to version 11.0.27000.0915, opening files greater than or equal to 20MB causes buffer overflow to