Vulnerability Description
The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) contains a cleartext DataDog API key within in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover the OAuth secret without special privileges. This secret is intended to remain confidential and should never be embedded directly in client-side software.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Flocksafety | Flock Safety | 7.38.3 |
Related Weaknesses (CWE)
References
- https://gainsec.com/2025/09/27/fly-by-device-2-the-falcon-sparrow-gated-wirelessExploitThird Party Advisory
- https://gainsec.com/wp-content/uploads/2025/09/Root-from-the-Coop-Device-3_-RootExploitThird Party Advisory
- https://www.flocksafety.com/productsProduct
- https://www.flocksafety.com/products/license-plate-readersProduct
FAQ
What is CVE-2025-59405?
CVE-2025-59405 is a vulnerability with a CVSS score of 7.5 (HIGH). The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) contains a clear...
How severe is CVE-2025-59405?
CVE-2025-59405 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-59405?
Check the references section above for vendor advisories and patch information. Affected products include: Flocksafety Flock Safety.