CVE-2025-59403

The Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for Android lacks authentication. It is responsible for the camera feed on Falcon, Sparrow, and Bravo devices, but exposes administrative API endpoints on port 8080 without authentication. Endpoints include but are not limited to: /reboot, /logs, /crashpack, and /adb/enable. This results in multiple impacts including denial of service (DoS) via /reboot, information disclosure via /logs, and remote code execution (RCE) via /adb/enable. The latter specifically results in adb being started over TCP without debugging confirmation, providing an attacker in the LAN/WLAN with shell access.

• CWE-749

• https://gainsec.com/2025/09/27/fly-by-device-2-the-falcon-sparrow-gated-wireless-rce-camera-feed-dos-information-disclosure-and-more/Exploit, Third Party Advisory
• https://gainsec.com/wp-content/uploads/2025/09/Root-from-the-Coop-Device-3_-Root-Shell-on-Flock-Safetys-Bravo-Compute-Box-GainSec.pdfExploit, Third Party Advisory
• https://www.flocksafety.com/productsProduct
• https://www.flocksafety.com/products/license-plate-readersProduct

Published

Oct 2, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59396Rejected reason: Not a security vulnerability
• CVE-2025-59397Open Web Analytics (OWA) before 1.8.1 allows owa_db.php v[va…5
• CVE-2025-59398The OCPP implementation in libocpp before 0.26.2 allows a de…3.1
• CVE-2025-59399libocpp before 0.28.0 allows a denial of service (EVerest cr…3.1
• CVE-2025-5940The Osom Blocks – Custom Post Type listing block plugin for …5.4
• CVE-2025-59402Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_…5.4
• CVE-2025-59404Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_…7.5
• CVE-2025-59405The Flock Safety Peripheral com.flocksafety.android.peripher…7.5
• CVE-2025-59406The Flock Safety Pisco com.flocksafety.android.pisco applica…6.2
• CVE-2025-59407The Flock Safety DetectionProcessing com.flocksafety.android…9.8
• CVE-2025-59408Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_…7.3
• CVE-2025-59409Flock Safety Falcon and Sparrow License Plate Readers OPM1.1…7.5