As cited
Copy frozen at (site build).
vulnerabilities
Flock can now issue CVEs for its own products. Should we trust it?
Flock, a public safety company that manufactures automated license plate readers and artificial intelligence (AI)-powered surveillance cameras, has been granted authority to assign CVE identifiers to vulnerabilities in its own products as a CVE Numbering Authority. Security experts and researchers express concern that Flock's history of privacy controversies and law enforcement misuse of its technology could compromise its credibility in self-assessing vulnerabilities, particularly given that the company's disclosure policy restricts testing against live deployments and reserves the right to withhold publication.
Why it matters: Security researchers, law enforcement agencies, and vulnerability coordinators need to scrutinize Flock's CVE submissions carefully to ensure accurate severity scoring and timely disclosure, since the company has faced repeated criticism over product misuse and may lack organizational maturity to fairly assess and report defects in surveillance systems deployed on public streets.
- Source published
- First seen by Cybersecurity Tracker