A hardcoded API key in the Flock Safety Android peripheral application exposes sensitive configuration credentials to unauthorized access, creating a significant information disclosure risk.

The application includes a cleartext DataDog API key within its codebase. Because the application binary can be decompiled or inspected, an unauthenticated attacker can extract this secret without requiring special privileges.

The exposure of an API key provides attackers with unauthorized access to monitoring infrastructure, which may lead to the compromise of sensitive operational data. With a CVSS score of 7.5, this vulnerability represents a high risk as it facilitates the potential for further reconnaissance or lateral movement within the environment. Failure to address this could result in significant security breaches and loss of confidentiality for the associated monitoring services.

Immediate Action: Contact Flock Safety support to determine if a patched version of the peripheral application is available and prioritize its deployment across all Falcon, Sparrow, and Bravo devices.

Proactive Monitoring: Review DataDog access logs for anomalous activity or unauthorized authentication attempts originating from unexpected IP addresses.

Compensating Controls: Implement strict network segmentation for affected compute devices to limit the blast radius, and rotate the exposed DataDog API keys immediately if rotation is supported by the vendor.

Public Exploit Available: Yes, a detailed technical write-up by GainSec documents the vulnerability and the extraction process.

Given the ease of extracting credentials from the application binary, this vulnerability presents a clear and present danger to the confidentiality of your monitoring environment. Organizations should treat this as a high priority and engage with Flock Safety to obtain the necessary firmware or software updates to rotate these keys and remove the hardcoded secret from the production codebase.