Flock can now assign CVEs to its own products

Flock, maker of license plate readers and AI surveillance cameras, has become a CVE Numbering Authority, allowing it to assign and grade vulnerabilities in its own products. Security experts warn of a conflict of interest, since the company writes descriptions and severity scores itself and can delay disclosure.

• Flock joins more than 550 organizations holding CNA status
• The company writes descriptions and sets severity scores for its own flaws
• Its policy bars testing on live deployments and physical attacks
• Flock does not run a paid bug bounty program