CVE-2025-59402
Flocksafety Bravo Compute Box Firmware
Raw vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:LSummary
CVE-2025-59402 is a medium-severity PHP (CWE-616) vulnerability in Flocksafety Bravo Compute Box Firmware. Its CVSS base score is 5.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Mobile/Edge AI; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified map to SA-8 (Security and Privacy Engineering Principles) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-31164
Vulnerability Data
Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode. This enables attackers with physical access to flash arbitrary firmware, dump partitions, and bypass bootloader and OS security controls.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Mobile/Edge AI
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Engineering principles such as complete mediation and least privilege require the use of the canonical $_FILES array rather than attacker-writable globals.
Proper validation of all file-upload inputs stops attackers from supplying or overwriting the legacy global variables that the flawed code relies on.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent use of the deprecated PHP upload globals and variable-overwrite flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect the legacy upload pattern before deployment.
Secure development lifecycle mandates proper input handling and file-upload validation, directly addressing the outdated global-variable approach.
Application security requirements include secure file-upload mechanisms that eliminate reliance on the four legacy PHP variables.
Secure architecture principles discourage unsafe global state, indirectly reducing exposure to variable-injection attacks.
Secure coding explicitly prohibits use of deprecated upload variables and requires validated, server-side file handling.