CVE-2025-59402

Published: Sep 25, 2025Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

Exploitability: 0.7 / Impact: 4.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode. This enables attackers with physical access to flash arbitrary firmware, dump partitions, and bypass bootloader and OS security controls.

Affected (1)

Products: Flocksafety: Bravo Compute Box Firmware

1 product

Bravo Compute Box Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Flocksafety Bravo Compute Box Firmware	All versions

Related CWEs

Incomplete Identification of Uploaded File Variables (PHP)

The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.

References (4)

https://gainsec.com/2025/09/19/root-from-the-coop-device-3-root-shell-on-flock-safetys-bravo-compute-box/

Source: cve@mitre.org

ExploitThird Party Advisory

https://gainsec.com/wp-content/uploads/2025/09/Root-from-the-Coop-Device-3_-Root-Shell-on-Flock-Safetys-Bravo-Compute-Box-GainSec.pdf

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.flocksafety.com/products

Source: cve@mitre.org

Product

https://www.flocksafety.com/products/license-plate-readers

Source: cve@mitre.org

Product

Timeline

No history available yet.