CVE-2025-59404
📋 TL;DR
The Flock Safety Bravo Edge AI Compute Device ships with an unlocked bootloader, allowing attackers with physical access to bypass Android Verified Boot and modify system partitions. This affects all devices running the BRAVO_00.00_local_20241017 firmware version. Physical access to the device is required for exploitation.
💻 Affected Systems
- Flock Safety Bravo Edge AI Compute Device
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing installation of persistent malware, data theft, device repurposing, and bypass of all security controls.
Likely Case
Unauthorized modification of device firmware to disable security features, alter functionality, or install backdoors.
If Mitigated
Limited impact if devices are physically secured and monitored for tampering.
🎯 Exploit Status
Detailed exploitation guide published. Requires physical access and basic technical skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Contact Flock Safety for firmware updates or replacement devices.
🔧 Temporary Workarounds
Physical Security Enhancement
allSecure devices in tamper-proof enclosures with surveillance to prevent physical access.
Device Monitoring
allImplement monitoring for device tampering indicators and unexpected reboots.
🧯 If You Can't Patch
- Physically secure devices in locked, monitored locations with limited access
- Implement device integrity monitoring and alert on unexpected behavior changes
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via device interface or serial console. If version is BRAVO_00.00_local_20241017, device is vulnerable.Check Version:
adb shell getprop ro.build.version.incrementalVerify Fix Applied:
Verify bootloader is locked by attempting to access fastboot mode and checking for 'Device State: unlocked' status.📡 Detection & Monitoring
Log Indicators:
- Unexpected device reboots
- Bootloader access attempts
- Firmware modification timestamps
Network Indicators:
- Unusual network traffic patterns from device
- Unexpected outbound connections
SIEM Query:
Device logs showing bootloader access or unexpected firmware changes🔗 References
- https://gainsec.com/2025/09/19/root-from-the-coop-device-3-root-shell-on-flock-safetys-bravo-compute-box/
- https://gainsec.com/wp-content/uploads/2025/09/Root-from-the-Coop-Device-3_-Root-Shell-on-Flock-Safetys-Bravo-Compute-Box-GainSec.pdf
- https://www.flocksafety.com/products
- https://www.flocksafety.com/products/license-plate-readers
