The security record

The federal government's vulnerability database lists 15 security flaws in Flock Safety devices, two of them rated 9.8 out of 10. Flock's answer is that exploiting them requires physical access and expert knowledge of its hardware, and that no customer action is required. Both of those things are on the record, and both belong on this page.

What is in the federal database

The National Vulnerability Database is run by the National Institute of Standards and Technology. It is the United States government's catalog of publicly disclosed software and hardware vulnerabilities. Searching it for "Flock Safety" returns 15 records.¹

We re-ran that query on July 29, 2026 and confirmed the count and every severity rating below.

Severity totals: 2 critical, 4 high, 4 medium, 5 low.¹

The two critical ones, in plain terms

CVE-2025-59403 — CVSS 9.8. The Android application that runs the camera feed on Falcon, Sparrow, and Bravo devices lacks authentication, exposing administrative API endpoints on port 8080 — including the ability to enable Android Debug Bridge, the developer tool that grants command-level control of a device.¹

CVE-2025-59407 — CVSS 9.8. The software bundles a Java keystore file containing a private key, together with its hardcoded password.¹ A hardcoded credential shipped inside distributed software is not a secret; it is a published one.

A 9.8 rating on a 10-point scale is close to the maximum. That score reflects what an attacker could do if they reach the interface — not how easy reaching it is, which is exactly the point Flock makes in response.

Flock Safety's response, quoted

Flock published a response to this research on November 6, 2025. Its core argument:

would not only require physical access to a device Flock Safety, Response to compiled security research on Flock Safety devices²

and further, that exploitation would require

intimate knowledge of internal device hardware Flock Safety²

The company also stated:

none of the vulnerabilities detailed in the report have an impact on our customers' ability to carry out Flock Safety, on customers' public safety objectives²

and concluded:

No customer action is required. Flock Safety²

To Flock's credit, and this should be said plainly: the company registered these vulnerabilities as CVEs through MITRE itself, and has pledged to CISA's Secure By Design initiative.² A vendor that files its own CVEs is behaving better than one that buries them.

Where that response is weakest

Flock's defense rests on physical access being hard. Two things complicate it.

First, these cameras are mounted in public right-of-way. A Flock Falcon sits on a pole beside a road, powered by solar, reachable by anyone who walks up to it. "Requires physical access" is a strong mitigation for a server in a locked data center. It is a much weaker one for hardware bolted to a residential street. Deer Park's nine cameras are, by design, in places the public can reach.

Second, at least some Flock cameras have been reachable over the internet without authentication. 404 Media documented cameras left streaming publicly, found by the musician and researcher Benn Jordan.³

The account security problem

The device vulnerabilities are not the whole picture. In November 2025, Senator Ron Wyden and Representative Raja Krishnamoorthi wrote to the Federal Trade Commission about Flock's platform security, reporting that the system did not require multi-factor authentication and that more than 35 accounts were found with stolen passwords.^4,5

This matters more for a small department than a large one. A single compromised login to a Flock account can search that account's cameras. If Deer Park's nine cameras are enrolled in any shared or national lookup arrangement — and nobody has told residents whether they are — the exposure is not limited to Deer Park's own officers' credentials.

What this means for a nine-camera city

We are not arguing that Deer Park's cameras have been hacked. We have no evidence of that, and we would say so if we did.

The argument is narrower and, we think, harder to dismiss:

1. These devices have a documented vulnerability history, including two near-maximum severity ratings.¹
2. The vendor's mitigation argument depends on physical access being difficult, and this hardware is installed on public streets.
3. The platform has had credential-security problems flagged by members of Congress.⁴
4. Deer Park has no published policy requiring anything of the vendor — no security standard, no breach notification, no audit right, no penalty.⁶

Cleveland's council addressed point four directly. When it renewed its Flock contract in July 2026, it added a contractual penalty of up to 25 percent of the contract value for violations of the privacy and data-sharing provisions, along with warrant-only disclosure and quarterly written reports to council.⁷

Deer Park's contract, as far as the public record shows, contains none of that. We do not know for certain, because the contract has never been published. Asking for it is the first step.