Flock, a public safety company that has faced scrutiny over law enforcement's use of its surveillance technology, has been authorized by CISA to assign CVE IDs to vulnerabilities in its own products. This designation allows Flock to internally assess, coordinate, and prioritize responses to security defects. The company stated this will enable faster responses to researcher findings, reduce confusion from duplicate entries, and provide customers with a single source for security information about their products, as first reported by Cyberscoop.
Flock, known for its automated license plate readers and AI-powered cameras, now joins over 550 other organizations as a CVE Numbering Authority (CNA). While many vendors are granted CNA status, Flock's authorization comes amid ongoing public and legal scrutiny regarding privacy concerns and reports of police misuse of its technology. Security experts note that the credibility of Flock as a CNA will depend on the accuracy and detail of its vulnerability records, enabling users to track specific risks, vulnerability types, and mitigation strategies. Flock has published a vulnerability disclosure policy and a security advisories page. However, some researchers plan to continue disclosing vulnerabilities independently. The company's policy restricts certain testing methods and does not include a paid bug bounty program. Experts express concerns about potential conflicts of interest, where a vendor might inaccurately represent vulnerabilities to downplay their impact, especially given Flock's unique position with law enforcement customers and its policy to potentially withhold disclosures deemed a safety risk.
Source: cyberscoop
