CVE-2025-47822
📋 TL;DR
Flock Safety LPR devices have an improperly secured on-chip debug interface that allows physical attackers to gain root access. This affects all Flock Safety Falcon and Sparrow license plate reader devices with firmware up to version 2.2. Attackers with physical access can bypass security controls and compromise the device.
💻 Affected Systems
- Flock Safety Falcon LPR
- Flock Safety Sparrow LPR
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Physical attacker gains root shell, extracts sensitive data (license plate databases, credentials), installs persistent malware, or repurposes device for other attacks.
Likely Case
Physical attacker gains root access to modify device functionality, extract collected license plate data, or disable security features.
If Mitigated
With proper physical security controls, the risk is limited to authorized personnel with physical access to device internals.
🎯 Exploit Status
Exploit requires opening device case and connecting to debug pads. Detailed technical walkthrough available in researcher reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3 or later
Vendor Advisory: https://www.flocksafety.com/articles/gunshot-detection-and-license-plate-reader-security-alert
Restart Required: Yes
Instructions:
1. Log into Flock Safety dashboard. 2. Navigate to device management. 3. Check for firmware updates. 4. Apply firmware version 2.3 or later. 5. Reboot device after update completes.
🔧 Temporary Workarounds
Physical Security Hardening
allImplement tamper-evident seals and physical security controls to prevent unauthorized access to device internals.
Network Segmentation
allIsolate LPR devices on separate network segments with strict firewall rules to limit lateral movement if compromised.
🧯 If You Can't Patch
- Implement strict physical security controls and tamper monitoring
- Isolate devices on segmented networks with minimal required access
🔍 How to Verify
Check if Vulnerable:
Check firmware version via Flock Safety dashboard or device web interface. If version ≤2.2, device is vulnerable.Check Version:
Not applicable - check via Flock Safety management interfaceVerify Fix Applied:
Confirm firmware version is 2.3 or later in device management interface.📡 Detection & Monitoring
Log Indicators:
- Physical tampering alerts
- Unexpected device reboots
- Firmware version changes
Network Indicators:
- Unexpected outbound connections from LPR devices
- Anomalous network traffic patterns
SIEM Query:
source="flock-lpr" AND (event="tamper_detected" OR event="firmware_change")🔗 References
- https://gainsec.com/2025/06/19/bird-hunting-season-security-research-on-flock-safety-anti-crime-systems/
- https://gainsec.com/2025/06/19/grounded-flight-device-2-root-shell-on-flock-safetys-falcon-sparrow-automated-license-plate-reader/
- https://gainsec.com/wp-content/uploads/2025/06/flock-safety-researcher-summary.pdf
- https://www.flocksafety.com/articles/gunshot-detection-and-license-plate-reader-security-alert
