CVE-2025-59402

Sept. 26, 2025, 9:15 p.m.

5.4
Medium

Description

Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode. This enables attackers with physical access to flash arbitrary firmware, dump partitions, and bypass bootloader and OS security controls.

Product(s) Impacted

Vendor Product Versions
Flock
  • Bravo Edge Ai Compute Device
  • BRAVO_00.00_local_20241017
Thundercomm
  • Turbox 6490
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-616
Incomplete Identification of Uploaded File Variables (PHP)
The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a flock bravo_edge_ai_compute_device BRAVO_00.00_local_20241017 / / / / / / /
a thundercomm turbox_6490 / / / / / / /

References

https://gainsec.com/2025/09/19/root-from-the-coop-device-3-root-shell-on-flock-safetys-bravo-compute-box/
https://gainsec.com/wp-content/uploads/2025/09/Root-from-the-Coop-Device-3_-Root-Shell-on-Flock-Safetys-Bravo-Compute-Box-GainSec.pdf
https://www.flocksafety.com/products
https://www.flocksafety.com/products/license-plate-readers

Tags

cve@mitre.org
CWE-616
2025-09-25
CVE-2025-59402

CVSS Score

5.4 / 10

CVSS Data - 3.1

  • Attack Vector: PHYSICAL
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: LOW
  • Integrity Impact: HIGH
  • Availability Impact: LOW

    • CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

    View Vector String

Timeline

Published: Sept. 25, 2025, 9:15 p.m.
Last Modified: Sept. 26, 2025, 9:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.