External risk intelligence

Flock Safety Android App Unauthenticated API Access Leading to RCE and DoS.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-59403

The application runs on Android devices (camera systems) and exposes administrative API endpoints on the local network (LAN/WLAN). While these services are network-reachable within the local environment, they are not intended to be exposed directly to the public internet, making public internet reachability uncommon in standard deployments.

Remote Code Execution

Flocksafety Flock Safety

6.35.31

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Flock Safety Android application used by certain camera devices, potentially allowing unauthorized access to administrative functions. This could lead to service disruptions, data exposure, or the execution of malicious code within your network.

Unauthenticated access to camera system controls.
Potential for unauthorized commands and data access.
Confirm relevance and exposure of affected devices.

Attack Path

How an attacker could exploit the issue

An attacker on the same local network can access administrative features of the Flock Safety Android app without needing any credentials. This access is provided through API endpoints exposed on port 8080, allowing them to potentially control device functions, view sensitive data, or even gain full control of the device.

Entry: Attacker on the local network.
Trigger: Accessing unauthenticated API endpoints.
Risk: Denial of service, information disclosure, or remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker on the same local network as Flock Safety devices to gain unauthorized access. Specifically, an attacker could remotely reboot devices, access logs containing potentially sensitive information, or even execute arbitrary code by enabling ADB over TCP without proper confirmation, effectively granting shell access to the device. This could disrupt the camera feed service or lead to a complete compromise of the device.

Device control and sensitive data.
Unauthenticated API access on local network.
Service disruption or device compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Flock Safety device owners, potentially managed by infrastructure or platform teams, are responsible for addressing this vulnerability. The initial practical step is to identify all deployed Flock Safety devices, confirm their network exposure and criticality, and then determine the accountable owner for remediation planning.

Device owners and platform teams.
Confirm device network exposure and criticality.
Plan remediation based on device criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Flock Safety Android Collins application?

It is an Android-based software component used to manage camera feeds for Falcon, Sparrow, and Bravo devices. These devices are commonly deployed for public safety and license plate recognition tasks, relying on this application to handle system operations and interface with the hardware.

What does CWE-749 mean in the context of CVE-2025-59403?

CWE-749 refers to the exposure of dangerous API methods. In this CVE, the application makes administrative functions, such as rebooting the system or enabling remote debugging, available through network endpoints without requiring any authentication, effectively allowing unauthorized users to interact with sensitive device controls.

How is this vulnerability triggered?

An attacker must be on the same local network (LAN/WLAN) as the device to access the unauthenticated API endpoints on port 8080. This issue does not require specific user interaction or valid credentials; however, it is not triggered by requests originating from outside the local network environment.

Do I need to worry if my devices are on a private network?

Yes, you should still evaluate the risk. According to Halo Surface Signal, these API endpoints are active on the local network. While the application is not typically reachable from the public internet, any unauthorized actor or compromised device already inside your local network boundary could interact with these administrative APIs.

How should I begin responding to this threat?

Start by performing an inventory to identify all deployed Flock Safety devices within your environment. Once identified, verify their current network placement and access controls to ensure they are isolated from unauthorized segments, then coordinate with your infrastructure teams to plan and apply the necessary updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.