Flock Cameras & LPRs: Self-Assigned CVE IDs Raise Transparency Fears
The controversial surveillance vendor gained authority to assign vulnerability IDs to its own cameras and license plate readers, sparking trust concerns.
Key points
- Flock Security joined the CVE Program as a Numbering Authority for its products.
- Critics question whether the company will maintain transparency given past privacy controversies.
- Researchers may continue to disclose vulnerabilities independently without coordinating with Flock.
Flock Security has officially joined the CVE Program as a CVE Numbering Authority, granting the company the power to assign identifiers to security flaws in its own surveillance hardware. This designation allows the manufacturer of AI-powered cameras and automated license plate readers to grade defects and coordinate responses internally, according to CyberScoop. The move places Flock among more than 550 CNAs globally that assess and prioritize vulnerability reporting.
Root cause
The decision stems from Flock’s desire to streamline its security operations. Chris Castaldo, the company’s chief information security officer, stated that becoming a CNA allows them to move faster when researchers report findings. He added that it eliminates confusion from duplicate entries and provides customers with a single trusted source for security information. Flock published a vulnerability disclosure policy in August and recently created a dedicated security advisories page for confirmed issues.
Attack path
Security experts note that the credibility of any CNA depends on the accuracy and detail of its records. Katie Moussouris, founder and CEO at Luta Security, told CyberScoop that the measure of Flock’s performance will be whether its records give cities and the public enough detail to track specific risks. She emphasized the need for information on product versions, vulnerability nature, and mitigation steps. However, Flock’s history of law enforcement abuse and privacy concerns clouds how researchers view this new role.
Affected versions
The CNA status applies to Flock’s entire portfolio of surveillance systems, including automated license plate readers and AI-powered cameras. The company did not specify which particular product versions or firmware releases are currently covered under this new authority. CyberScoop reported that Flock declined to answer specific questions or make an executive available for an interview, referring instead to a blog post.
Mitigation
- Monitor Flock’s new security advisories page for confirmed vulnerabilities.
- Review the company’s vulnerability disclosure policy published in August.
- Track independent researcher disclosures that may bypass coordination with Flock.
What to do and how to stay safe: Flock Security
- Check your organization’s inventory for Flock Security surveillance hardware.
- Subscribe to security advisories from Flock and independent researchers.
- Verify that your vendor contracts include timely vulnerability disclosure clauses.
- Review access controls for any network segments hosting these devices.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What does it mean for Flock to be a CVE Numbering Authority?
It means Flock can officially assign CVE IDs to vulnerabilities found in its own products and grade their severity.
Are security experts concerned about this change?
Yes, experts note that Flock’s past privacy controversies and reports of police abuse could affect how researchers view its credibility as a CNA.
Will researchers still report bugs to outsiders?
Zach Edwards, a security researcher, expects some activists and researchers to continue disclosing vulnerabilities without coordinating with the company.
