CVE-2025-59402
📋 TL;DR
This vulnerability allows attackers with physical access to Flock Safety Bravo Edge AI Compute devices to flash arbitrary firmware, dump partitions, and bypass bootloader and OS security controls. It affects Flock Safety Bravo Edge AI Compute devices using the Thundercomm TurboX 6490 platform. Physical access to the device is required for exploitation.
💻 Affected Systems
- Flock Safety Bravo Edge AI Compute Device
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing installation of malicious firmware, data exfiltration, persistent backdoors, and bypass of all security controls.
Likely Case
Physical attacker gains full control of the device to modify functionality, extract sensitive data, or disable security features.
If Mitigated
Limited impact if physical access controls prevent unauthorized handling of devices.
🎯 Exploit Status
Requires physical access and technical knowledge of EDL/QDL flashing procedures. No authentication bypass needed once physical access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UNKNOWN
Vendor Advisory: NONE
Restart Required: No
Instructions:
No official patch available. Contact Flock Safety for firmware updates or security guidance.
🔧 Temporary Workarounds
Disable EDL/QDL Mode
allConfigure device to disable Emergency Download Mode/Qualcomm Download Mode if supported by firmware.
NONE - Requires firmware configuration
Secure Physical Access
allImplement physical security controls to prevent unauthorized handling of devices.
NONE - Physical security measures
🧯 If You Can't Patch
- Implement strict physical access controls and monitoring for all deployed devices.
- Consider device tamper detection mechanisms and regular integrity checks of firmware.
🔍 How to Verify
Check if Vulnerable:
Check if device accepts default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode by attempting to connect via Qualcomm tools.Check Version:
Check device firmware version via manufacturer's management interface or console.Verify Fix Applied:
Verify EDL/QDL mode requires authentication or is disabled in updated firmware.📡 Detection & Monitoring
Log Indicators:
- Unexpected device reboots
- Firmware version changes
- EDL/QDL mode activation logs
Network Indicators:
- Unusual device communication patterns after physical access
SIEM Query:
Search for device firmware modification events or unauthorized physical access alerts.🔗 References
- https://gainsec.com/2025/09/19/root-from-the-coop-device-3-root-shell-on-flock-safetys-bravo-compute-box/
- https://gainsec.com/wp-content/uploads/2025/09/Root-from-the-Coop-Device-3_-Root-Shell-on-Flock-Safetys-Bravo-Compute-Box-GainSec.pdf
- https://www.flocksafety.com/products
- https://www.flocksafety.com/products/license-plate-readers
