Flock Safety LPR Devices Hardcoded Password Vulnerability

A vulnerability exists in Flock Safety License Plate Reader (LPR) devices running firmware through version 2.2, which have a hardcoded password for system access. This vulnerability is classified under CWE-798 (Hardcoded Credentials) and CWE-259 (Hardcoded Connection Details).

Impact

The vulnerability allows for unauthorized access to the device's system, potentially leading to exploitation of the debug interface, which is also enabled on the devices. However, physical access to the device is required to exploit this vulnerability.

Remediation

Flock Safety will address this vulnerability through Over the Air Updates and improved factory settings for new devices, starting in Q2 2025.