Flock, the controversial public safety company entangled in controversy amid recurring law enforcement abuse of its products, gained authority to assign CVE IDs to vulnerabilities in its own products and grade those defects as a CVE Numbering Authority.
The manufacturer of various surveillance systems, including automated license plate readers (ALPRs) and AI-powered cameras, said it joined the global footprint of more than 550 CNAs to assess, coordinate and prioritize response to vulnerabilities internally.
“It allows us to move faster when researchers report findings, eliminate confusion from duplicate or conflicting vulnerability entries and give our customers a single, trusted source for security information about our products,” Chris Castaldo, chief information security officer at Flock, said in a statement.
Security experts acknowledge that many vendors are granted CNA authority for good reason. Separately, Flock’s business has drawn considerable public and legal scrutiny over privacy concerns, along with multiple reports of police abusing the technology.
Controversies stemming from such misuse have impacted Flock’s credibility and could cloud how security researchers view the company as a CNA. The development also highlights the limitations of the CVE program, including what constitutes a vulnerability.