# Flock vendor security advisory for LPR and gunshot devices > *Audited source extract. The dossier was used only as a lead; the underlying source was independently acquired and checked on 2026-07-20.* ## Source metadata - **Publisher:** Flock Safety - **Original dossier URL:** https://www.flocksafety.com/blog/gunshot-detection-and-license-plate-reader-security-alert - **Resolved/canonical URL used:** https://www.flocksafety.com/blog/gunshot-detection-and-license-plate-reader-security-alert - **Publication date:** 2025-05-05 - **Underlying event or version:** 2025-05-05 - **Archived:** 2026-07-20, from unauthenticated public access; no cookies, tokens, or login state retained - **Wayback snapshot:** save failed on 2026-07-20 after the archive service returned HTTP 403; retry pending ## Verification verdict **supported with narrower wording** — Flock acknowledged the first seven CVEs but characterized them as low likelihood and physical-access dependent, stated that it had not determined deployed-device remediation was needed, and promised OTA/factory changes. This is the vendor's May 2025 position, not a fixed-version attestation. ## Claim boundary This source is authoritative only within the source class and limitations stated above. ## Extract **Extracted-text lines 261-265:** > ‍ > These are not material vulnerabilities, and both severity and likelihood to be exploited are low. The exploitation of these vulnerabilities require > physical access to a device > and knowledge of device debugging. If a person was able to gain physical access to the device (which is typically placed on a pole several feet above normal height), they would still not be able to gain access to footage, as the data is only stored for a very limited time duration on the device following its transmission to the cloud. > None of these vulnerabilities affect our cloud platform, where the vast majority of all evidence and metadata is stored. Flock secures data in accordance with industry requirements, including encryption using AES-256, as validated by the company’s ISO 27001 compliance certification. **Wayback failure**: The bounded Save Page Now pass stopped after the archive service returned HTTP 403 on the first request. This source was not individually retried; retry pending. ## Notes - Tier: 2 — vendor primary/self-description; authoritative only for the vendor's own claims. - The excerpt is bounded to the claims audited here; consult the preserved original for full context. - Cited by: see `citing_pages:` frontmatter; populated after wiki integration.