PT-2025-40412 · Flock Safety · Flock Safety Pisco+3

Gainsec · Published 2025-10-02 · Updated 2025-10-24 · CVE-2025-59406

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Flock Safety Pisco application version 6.21.11

Description The Flock Safety Pisco application for Android contains a cleartext Auth0 client secret within its codebase. Attackers can recover this OAuth secret without elevated privileges by decompiling or inspecting the application binaries. The secret is intended to be confidential and should not be embedded directly in client-side software. The application is installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2025-59406

Affected Products

Bravo Edge Ai Compute Device

Falcon License Plate Readers

Flock Safety Pisco

Sparrow License Plate Readers

References · 10

• 🔥 https://gainsec.com/wp-content/uploads/2025/09/Root-from-the-Coop-Device-3_-Root-Shell-on-Flock-Safetys-Bravo-Compute-Box-GainSec.pdf · Exploit
• 🔥 https://gainsec.com/2025/09/27/fly-by-device-2-the-falcon-sparrow-gated-wireless-rce-camera-feed-dos-information-disclosure-and-more · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59406 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59406 · Vendor Advisory
• https://flocksafety.com/products · Note
• https://flocksafety.com/products/license-plate-readers · Note
• https://t.me/CVEtracker/33963 · Telegram Post
• https://t.me/cveNotify/140250 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1973957434801578212 · Twitter Post
• https://twitter.com/CVEnew/status/1973802345671663951 · Twitter Post