CVE-2026-124038
LOW
INFO
Priority: 0.00
BB Relevance:
27/100
Published: 2026-11-10
Modified: 2026-11-12
First seen: 2026-11-10
Status: active
Attack Surface
Adjacent
Low Complexity
CVSS Vector Breakdown
AV:
Adjacent
AC:
Low
PR:
Low
UI:
Passive
S:
X
AT:
Present
VC:
None
VI:
None
VA:
Low
Description
An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a camera configuration response that contains nested XML entity declarations. The vulnerability does not allow the attacker to read or change data on the device, and no customer license plate, video or location data is exposed. Android 13 and later reject the response. The issue is fixed in version 2.35.0; update to 2.35.0 or later.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Flock | Flock Installer app | 0 < 2.35.0 |
| Flock | Flock Installer app | 0 < 2.35.0 |
References & Advisories (1)
vendor-advisory