{"id":"CVE-2026-124038","kind":"vulnerability","aliases":["CVE-2026-124038"],"related":[],"title":"Flock Installer for Android: XML expansion lets a crafted camera response crash the app","description":"An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a camera configuration response that contains nested XML entity declarations. The vulnerability does not allow the attacker to read or change data on the device, and no customer license plate, video or location data is exposed. Android 13 and later reject the response. The issue is fixed in version 2.35.0; update to 2.35.0 or later.","summary":"The Flock Installer app for Android, before version 2.35.0, does not limit XML entity expansion, so a camera configuration response with nested entity declarations can crash the app. The sources say it does not expose or change data, and Android 13 and later reject the response.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","camera-installers","flock-safety","vendor"],"not_affected_if":["android-13-or-later","app-version-2.35.0-or-later"],"how_to_check":"- Check the installed Flock Installer app version on the Android device and compare it with `2.35.0`.\n- Check the Android version on the device; the sources say Android 10, 11 or 12 are affected.","fix":"- Flock Installer for Android: update to `2.35.0` or later.","status":"open","published_at":"2026-11-10T16:17:18+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","triaged_at":"2026-11-10T16:23:47+00:00","updated_at":"2026-11-10T16:23:47+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-10T16:23:47Z","model":"claude-haiku-5-5","output":{"fix":"- Flock Installer for Android: update to `2.35.0` or later.","reach":"network","title":"Flock Installer for Android: XML expansion lets a crafted camera response crash the app","impact":"low","summary":"The Flock Installer app for Android, before version 2.35.0, does not limit XML entity expansion, so a camera configuration response with nested entity declarations can crash the app. The sources say it does not expose or change data, and Android 13 and later reject the response.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["flock-safety","android","camera-installers"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"The installer app crashes on the technician's Android device","analyst_note":"","how_to_check":"- Check the installed Flock Installer app version on the Android device and compare it with `2.35.0`.\n- Check the Android version on the device; the sources say Android 10, 11 or 12 are affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["android-13-or-later","app-version-2.35.0-or-later"],"who_is_affected":"Only the Flock Installer app on Android 10, 11 or 12 is affected, and the attacker must hold a valid technician account and control or impersonate the camera being set up. Devices on Android 13 or later reject the malicious response, and the sources say no customer license plate, video or location data is exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000726,"input_tokens":4648,"output_tokens":523,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-124038':17A,20A '-2026':16A,19A '10':117C '11':118C '12':120C '13':69B,160C '2.35.0':37B,90C,172C,175C 'account':99C 'allow':91C,137C 'android':4A,21B,34B,68B,87C,116C,159C 'app':14A,32B,56B,85C,112C 'attack':93C,139C 'camera':10A,23B,46B,105C,124C 'camera-instal':22B 'chang':65B,143C 'configur':47B,125C 'contain':128C 'control':101C 'craft':9A 'crash':12A,54B,110C 'custom':150C 'cve':15A,18A 'data':66B,144C,156C 'declar':52B,132C 'devic':114C,147C 'entiti':42B,51B,78C,131C 'expans':6A,43B,79C 'expos':63B,158C 'fix':169C 'flock':1A,26B,30B,83C 'flock-safeti':25B 'imperson':103C 'instal':2A,24B,31B,84C 'issu':167C 'later':71B,162C,177C 'let':7A 'licens':151C 'limit':40B 'locat':155C 'nest':50B,129C 'plate':152C 'read':141C 'reject':72B,163C 'respons':11A,48B,74B,126C,165C 'return':122C 'run':115C 'safeti':27B 'say':59B 'set':107C 'sourc':58B 'technician':98C 'uncontrol':76C 'updat':173C 'valid':97C 'vendor':28B 'version':36B,89C,171C 'video':153C 'vulner':80C,134C 'xml':5A,41B,77C,130C","nicknames":[],"mitigations":[],"who_affected":"Only the Flock Installer app on Android 10, 11 or 12 is affected, and the attacker must hold a valid technician account and control or impersonate the camera being set up. Devices on Android 13 or later reject the malicious response, and the sources say no customer license plate, video or location data is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","camerainstallers","flocksafety","low","vendor"],"campaign_type":null,"search_a":"'-124038':17A,20A '-2026':16A,19A 'android':4A 'app':14A 'camera':10A 'craft':9A 'crash':12A 'cve':15A,18A 'expans':6A 'flock':1A 'instal':2A 'let':7A 'respons':11A 'xml':5A","search_b":"'13':69B '2.35.0':37B 'android':21B,34B,68B 'app':32B,56B 'camera':23B,46B 'camera-instal':22B 'chang':65B 'configur':47B 'crash':54B 'data':66B 'declar':52B 'entiti':42B,51B 'expans':43B 'expos':63B 'flock':26B,30B 'flock-safeti':25B 'instal':24B,31B 'later':71B 'limit':40B 'nest':50B 'reject':72B 'respons':48B,74B 'safeti':27B 'say':59B 'sourc':58B 'vendor':28B 'version':36B 'xml':41B","search_c":"'10':117C '11':118C '12':120C '13':160C '2.35.0':90C,172C,175C 'account':99C 'allow':91C,137C 'android':87C,116C,159C 'app':85C,112C 'attack':93C,139C 'camera':105C,124C 'chang':143C 'configur':125C 'contain':128C 'control':101C 'crash':110C 'custom':150C 'data':144C,156C 'declar':132C 'devic':114C,147C 'entiti':78C,131C 'expans':79C 'expos':158C 'fix':169C 'flock':83C 'imperson':103C 'instal':84C 'issu':167C 'later':162C,177C 'licens':151C 'locat':155C 'nest':129C 'plate':152C 'read':141C 'reject':163C 'respons':126C,165C 'return':122C 'run':115C 'set':107C 'technician':98C 'uncontrol':76C 'updat':173C 'valid':97C 'version':89C,171C 'video':153C 'vulner':80C,134C 'xml':77C,130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124038","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124038","severity":null,"published_at":"2026-11-10T16:17:18+00:00","modified_at":"2026-11-10T16:17:18+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","fetched_at":"2026-11-10T16:22:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}