CVE-2025-59407

The vulnerability consists of hardcoding the password to a Java Keystore file directly in the application code (CWE-321). Anyone who gains access to the application APK file can extract the flock_rye.bks file and read the hardcoded password flockhibiki17, then use them to open the keystore and obtain the private key contained within. This key is installed on Falcon and Sparrow license plate readers and Bravo Edge AI Compute devices.

An attacker who obtains the private key from the keystore can impersonate Flock Safety devices, conduct man-in-the-middle attacks, gain unauthorized access to encrypted device communication, or potentially execute remote commands (RCE) on vulnerable devices.

Patches available from the manufacturer should be applied in accordance with references. The manufacturer should remove the hardcoded password and keystore file from the application code, implement secure key management mechanisms, and replace the compromised private key with a new one.

Flock Safety DetectionProcessing application com.flocksafety.android.objects version 6.35.33 for Android, installed on Falcon and Sparrow license plate readers and Bravo Edge AI Compute devices.