CVE-2025-59403 identifies a critical security flaw in the Flock Safety Android Collins application (com.flocksafety.android.collins) version 6.35.31, which is responsible for managing camera feeds from Falcon, Sparrow, and Bravo security devices. The vulnerability arises because the application exposes several administrative API endpoints on TCP port 8080 without enforcing any authentication or authorization mechanisms. These endpoints include /reboot, which can be used to cause denial of service by rebooting the device; /logs, which allows attackers to retrieve potentially sensitive operational logs leading to information disclosure; /crashpack, which may provide crash data; and most critically, /adb/enable, which enables Android Debug Bridge (adb) over TCP without requiring user confirmation or authentication. Enabling adb over TCP grants an attacker on the local network shell access to the device, effectively allowing remote code execution (RCE). This combination of unauthenticated access and powerful administrative functions results in a vulnerability with a CVSS v3.1 base score of 9.8, reflecting its critical impact on confidentiality, integrity, and availability. The vulnerability is classified under CWE-749 (Exposed Dangerous Method or Function). Although no known exploits have been reported in the wild yet, the ease of exploitation and severity make it a high-priority issue. The lack of available patches at the time of disclosure further increases risk. The affected devices are typically deployed in physical security contexts, making them attractive targets for attackers seeking to disrupt surveillance or gain unauthorized access to camera feeds and device controls.

For European organizations, the impact of CVE-2025-59403 is significant due to the critical nature of the vulnerability and the role of affected devices in physical security infrastructure. Exploitation could lead to denial of service by rebooting security cameras, causing temporary loss of surveillance coverage. Information disclosure through access to logs could reveal sensitive operational details or network configurations, aiding further attacks. The most severe impact is remote code execution via enabling adb over TCP, which allows attackers to gain shell access and potentially pivot within the network, compromise other systems, or manipulate camera feeds and device configurations. This could undermine security monitoring, violate privacy regulations such as GDPR, and cause reputational damage. Organizations relying on Flock Safety devices for perimeter security, law enforcement, or critical infrastructure protection are particularly vulnerable. The vulnerability's exploitation requires network access, so organizations with poorly segmented or unsecured LAN/WLAN environments face higher risk. The absence of patches means that without immediate mitigations, European entities remain exposed to potential attacks that could disrupt security operations and lead to data breaches.

Given the absence of available patches, European organizations should implement immediate compensating controls to mitigate CVE-2025-59403. First, restrict network access to port 8080 on affected devices by implementing strict firewall rules and network segmentation, ensuring only trusted management hosts can communicate with these endpoints. Disable or isolate wireless networks where these devices operate to reduce attacker access. Monitor network traffic for unusual connections to port 8080 or unexpected adb activity. Employ network intrusion detection systems (NIDS) with signatures for adb over TCP or suspicious API calls. Where possible, disable or restrict adb functionality on devices manually. Conduct thorough audits of device configurations and logs to detect any signs of compromise. Engage with Flock Safety support to obtain updates on patch availability and apply them promptly once released. Additionally, review physical security policies to ensure devices are deployed in secure environments minimizing unauthorized local network access. Educate IT and security teams about this vulnerability to enhance detection and response capabilities.