← Back to search

CVE-2026-124038

2.3 LOW

Published 2026-11-10 · Updated 2026-11-10

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a camera configuration response that contains nested XML entity declarations. The vulnerability does not allow the attacker to read or change data on the device, and no customer license plate, video or location data is exposed. Android 13 and later reject the response. The issue is fixed in version 2.35.0; update to 2.35.0 or later.

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L

Weaknesses

CWE-776

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.