Flock can now issue CVEs for its own products. Should we trust it?
Flock Safety became a CVE Numbering Authority for vulnerabilities in its own surveillance products.
Flock Safety joined the CVE Program as a CVE Numbering Authority, letting it assign identifiers and severity scores for flaws in its surveillance cameras and automated license plate readers. The company says CNA status will speed researcher coordination and avoid duplicate entries. Security experts, including Katie Moussouris, warn that vendors grading their own products may understate impact, and Flock’s policy can withhold publication over law-enforcement safety concerns. Flock has no paid bug bounty and previously judged physically accessible defects not material for the National Vulnerability Database.
- Flock Safety joined the CVE Program as a CNA for its own products.
- It can assign CVE IDs and severity for cameras and license plate readers.
- Experts warn an immature vendor may downplay flaws or delay disclosure.
- Flock has no paid bounty and bars tests of live customer deployments.
- Vendors
- Flock Safety
- Organizations
- Flock SafetyCVE ProgramLuta Security
From the original article
4 min read at cyberscoop.com
Flock joined the CVE Program as a CNA, giving the company authority to assign IDs to vulnerabilities in its own surveillance cameras and license plate readers. The post Flock can now issue CVEs for its own products. Should we trust it?
By Matt Kapko · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.