Flock Safety License Plate Reader Devices Improper Access Control Vulnerability

A vulnerability exists in Flock Safety License Plate Reader (LPR) devices running firmware through 2.2, allowing improper access control to an on-chip debug interface. This vulnerability requires physical access to the device and knowledge of debugging techniques to exploit. While the debug interface is enabled, the vulnerability does not provide access to recorded footage, as data is only temporarily stored on the device before being transmitted to the cloud, where it is securely encrypted.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the device's debug interface, potentially allowing for further manipulation or extraction of information, such as hardcoded credentials or connection details.

Remediation

Flock Safety plans to address this vulnerability through Over the Air Updates and improved factory settings for new devices, starting in Q2 2025.