CVE-2025-59407 Hardcoded credentials in n/a

Critical 9.8 Published 2 Oct 2025 Updated 2 Oct 2025

Hardcoded keystore password in Android app allows attackers to extract private keys, compromising security on Flock Safety devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-59407?

CVE-2025-59407 is a critical vulnerability in n/a, published on 2 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) bundles a Java Keystore (flock_rye.bks) along with its hardcoded password (flockhibiki17) in its code. The keystore contains a private key.

Weakness: CWE-321

Which versions are affected by CVE-2025-59407?

It affects 1 product.

Products include Flocksafety Flock Safety.

How do I fix CVE-2025-59407?

No fix has been published for CVE-2025-59407 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-59407 being exploited?

There is no known exploitation of CVE-2025-59407 in the wild and no public exploit code.

Sources

Also known as GHSA-pv25-m64m-8qhp.