What is the CVSS score of CVE-2025-59403?

CVE-2025-59403 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.7%.

Which versions of Flock Safety are affected by CVE-2025-59403?

CVE-2025-59403 presents critical security risk rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems.

Is there a public PoC exploit available for CVE-2025-59403?

Yes, a public proof-of-concept exploit is available for CVE-2025-59403. Prioritise patching immediately. EPSS: 2.7%.

How to fix or mitigate CVE-2025-59403?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Flock Safety CVE-2025-59403

EUVD-2025-32616 CRITICAL

Exposed Dangerous Method or Function (CWE-749)

2025-10-02 cve@mitre.org

Denial Of Service RCE Information Disclosure Flock Safety Android

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 19:12 euvd

EUVD-2025-32616

Analysis Generated

Mar 13, 2026 - 19:12 vuln.today

PoC Detected

Nov 24, 2025 - 15:15 vuln.today

Public exploit code

CVE Published

Oct 02, 2025 - 17:16 nvd

CRITICAL 9.8

DescriptionCVE.org

The Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for Android lacks authentication. It is responsible for the camera feed on Falcon, Sparrow, and Bravo devices, but exposes administrative API endpoints on port 8080 without authentication. Endpoints include but are not limited to: /reboot, /logs, /crashpack, and /adb/enable. This results in multiple impacts including denial of service (DoS) via /reboot, information disclosure via /logs, and remote code execution (RCE) via /adb/enable. The latter specifically results in adb being started over TCP without debugging confirmation, providing an attacker in the LAN/WLAN with shell access.

AnalysisAI

Missing authentication in Flock Safety Collins Android app for ANPR cameras. EPSS 2.7%. PoC available.

Technical ContextAI

CWE-749. License plate recognition system without authentication.

RemediationAI

Update app.

CVE-2025-59403 vulnerability details – vuln.today

Back

Flock Safety CVE-2025-59403

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code