Cyber Posture

CVE-2025-59403

CriticalPublic PoC

Published: 02 October 2025

Published
02 October 2025
Modified
24 November 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0261 85.7th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as [Network Sniffing](https://attack.

Security Summary

CVE-2025-59403 is a critical vulnerability in the Flock Safety Android Collins application (package name com.flocksafety.android.collins), specifically version 6.35.31 for Android. This application manages camera feeds on Falcon, Sparrow, and Bravo devices but exposes multiple administrative API endpoints on TCP port 8080 without any authentication. Affected endpoints include, but are not limited to, /reboot, /logs, /crashpack, and /adb/enable. The issue stems from CWE-749 (Exposed Dangerous Method or Function) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

An unauthenticated attacker with network access to the exposed port can exploit these endpoints remotely. Potential impacts include denial of service through the /reboot endpoint, which forces a device restart; information disclosure via /logs and /crashpack, exposing sensitive logs and crash data; and remote code execution via /adb/enable, which starts Android Debug Bridge (ADB) over TCP without requiring debugging confirmation. This grants an attacker on the same LAN or WLAN shell access to the device.

Advisories detailing the vulnerability are published by GainSec at https://gainsec.com/2025/09/27/fly-by-device-2-the-falcon-sparrow-gated-wireless-rce-camera-feed-dos-information-disclosure-and-more/ and https://gainsec.com/wp-content/uploads/2025/09/Root-from-the-Coop-Device-3_-Root-Shell-on-Flock-Safetys-Bravo-Compute-Box-GainSec.pdf. Additional context on affected Flock Safety products, such as license plate readers, is available at https://www.flocksafety.com/products and https://www.flocksafety.com/products/license-plate-readers. No specific patch or mitigation details are provided in the CVE description.

Details

CWE(s)
CWE-749

Affected Products

flocksafety
flock safety
6.35.31

MITRE ATT&CK Enterprise Techniques

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1529 System Shutdown/Reboot Impact
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
attack.mitre.org →
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
attack.mitre.org →
T1552.004 Private Keys Credential Access
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.
attack.mitre.org →
T1557.004 Evil Twin Credential Access
Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
Why these techniques?

Unauthenticated API endpoints enable exploitation for RCE via ADB shell (T1210, T1059.004), reboot/DoS (T1529), and local data disclosure via logs (T1005). Hardcoded credentials and keys in apps (T1552.001, T1552.004) and WiFi creds facilitate evil twin attacks (T1557.004).

References