Executive Summary

This vulnerability exists in the Flock Safety Android Collins application version 6.35.31, which manages camera feeds on certain devices. The app exposes administrative API endpoints on port 8080 without requiring authentication. These endpoints include actions like rebooting the device, accessing logs, and enabling adb over the network. Because there is no authentication, an attacker on the local network can exploit these endpoints to cause denial of service, disclose sensitive information, or gain remote code execution by starting adb over TCP without confirmation, effectively giving shell access.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to multiple impacts: denial of service by rebooting the device remotely, information disclosure through access to logs, and remote code execution by enabling adb over TCP without user confirmation. This allows an attacker on the local network to gain shell access to the device, potentially compromising the device and its data.

Useful 0 Not Useful 0