Flock Security Gains CVE Numbering Authority for Surveillance Products
The surveillance vendor joined the CVE Program as a CNA, allowing it to assign IDs and grade vulnerabilities in its own cameras and license plate readers.
Key points
- Flock Security has been designated a CVE Numbering Authority, joining over 550 other organizations with this capability.
- The company states this role allows for faster response to researcher findings and a single source for security information.
- Critics and experts warn that Flock’s history of privacy controversies may affect how researchers view its self-assigned vulnerability ratings.
Flock Security has officially joined the CVE Program as a CVE Numbering Authority, granting the company the power to assign Common Vulnerabilities and Exposures identifiers to defects in its own hardware. According to CyberScoop, this designation allows the manufacturer of automated license plate readers and AI-powered surveillance cameras to grade the severity of vulnerabilities in its products internally.
The company states that becoming a CNA enables it to move more quickly when security researchers report findings. Chris Castaldo, chief information security officer at Flock, said in a statement that the role eliminates confusion from duplicate entries and provides customers with a single, trusted source for security information regarding their products.
Context and Industry Reaction
Security experts acknowledge that granting CNA authority to vendors is a standard practice intended to streamline vulnerability management. However, Flock’s business operations have drawn significant public and legal scrutiny due to privacy concerns and multiple reports of law enforcement abusing its technology. These controversies have impacted the company’s credibility, which could influence how the security community perceives its actions as a CNA.
Katie Moussouris, founder and CEO at Luta Security, told CyberScoop that the measure of Flock’s success as a CNA depends on the detail and accuracy of its records. She noted that cities, police departments, and the public need sufficient information to track specific risks by product version, vulnerability nature, and mitigation steps.
Flock declined to answer direct questions or make an executive available for an interview regarding this development. Instead, the company referred inquiries to a blog post. The firm published its vulnerability disclosure policy in August and recently created a security advisories page where it will publish all newly discovered and confirmed vulnerabilities.
Who Is Affected
The development highlights broader limitations within the CVE program, including questions about what constitutes a valid vulnerability and who should assess it. Zach Edwards, a security and privacy researcher, noted that numerous activists have previously conducted technical teardowns of Flock’s products. He expects some researchers to continue disclosing vulnerabilities found in Flock’s devices without coordinating with the company first.
This lack of coordination means that independent disclosures may still occur alongside Flock’s official CNA activities. The tension between vendor-managed disclosure and independent research remains a key dynamic for organizations using Flock’s surveillance systems.
What should you do?
Organizations using Flock’s surveillance technology should monitor the company’s new security advisories page for confirmed vulnerabilities. They should also continue to watch for independent disclosures from security researchers who may not coordinate with Flock. Agencies should ensure their vulnerability tracking processes account for both official CVEs and external reports.
What to do and how to stay safe: Flock Security
- Monitor Flock’s newly created security advisories page for official notifications regarding confirmed vulnerabilities in your deployed hardware.
- Subscribe to feeds from independent security researchers and privacy advocates who frequently analyze Flock’s products for undisclosed flaws.
- Establish an internal process to cross-reference vendor-assigned CVEs with external reports to ensure a complete view of potential risks.
- Review your current vulnerability disclosure policy to ensure it accounts for both coordinated and uncoordinated disclosures from third parties.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What does it mean for Flock to be a CNA?
It means Flock can now assign CVE IDs and grade the severity of vulnerabilities in its own products, such as cameras and license plate readers.
Why is Flock’s CNA status controversial?
The company faces scrutiny over privacy concerns and reports of law enforcement abuse, which may affect how researchers trust its self-assigned vulnerability ratings.
Will researchers still disclose Flock vulnerabilities independently?
Yes, security researcher Zach Edwards expects some activists to continue disclosing findings without coordinating with the company.
