cve.bz

CVE-2026-124038

1.0 low

Low (1.0) in flock flock installer app.

On this page
An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a camera configuration response that contains nested XML entity declarations. The vulnerability does not allow the attacker to read or change data on the device, and no customer license plate, video or location data is exposed. Android 13 and later reject the response. The issue is fixed in version 2.35.0; update to 2.35.0 or later.

Severity

CVSS 4.0

1.0 low
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

2.3 low
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
CWE
CWE-776 Improper Restriction of Recursive Entity References in DTDs (Billion Laughs Attack)
OWASP Top 10
A02:2025 Security Misconfiguration
Published
Assigned by
flock (CNA)
NVD analysis
Not in the NVD yet
Record from
the CVE List, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-124038 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-124038?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-124038?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-124038 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Affected

  • flock:flock installer app

Versions

From the CNA's record in the CVE List.

ProductAffected
Flock Installer appbefore 2.35.0

Attack patterns (CAPEC)

  • CAPEC-197 Exponential Data Expansion Likelihood: High · Severity: Medium

The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.

References

Check your stackJSON