Brightpick Mission Control Vulnerabilities: Missing Auth, Hardcoded Creds, Info Disclosure (CVE-2025-64307/308/309)

Key Information Summary Vulnerability Overview CVSS v4 Score: 8.7 Severity Indicator: Remotely exploitable / Low attack complexity Vendor: Brightpick AI Device: Brightpick Mission Control / Internal Logic Control Vulnerabilities: Missing authentication for critical functions, unprotected credential transmission Risk Assessment Successful exploitation of these vulnerabilities could lead to exposure of sensitive information and manipulation of critical functions. Technical Details Affected Products: All versions of Brightpick Mission Control / Internal Logic Control. Vulnerability Overview - Missing Authentication for Critical Functions CWE-306 - Description: Unauthenticated users can manipulate robot control functions via the web interface. - CVE: CVE-2025-64307, CVSS v3.1: 6.5, CVSS v4: 7.1 - Unprotected Credential Transmission CWE-523 - Description: Hardcoded credentials exposed in client-side JavaScript bundles. - CVE: CVE-2025-64308, CVSS v3.1: 7.5, CVSS v4: 8.7 - WebSocket Traffic in Device Discloses Sensitive Information CWE-523 - Description: Unauthorized users can access device information via specific URLs. - CVE: CVE-2025-64309, CVSS v3.1: 8.6, CVSS v4: 8.2 Background Critical Infrastructure Sectors: Commercial facilities, critical manufacturing, healthcare and public health. Deployment Countries/Regions: Global. Company Headquarters: Slovakia. Researchers Souvik Kandar reported these vulnerabilities to CISA. Mitigation Measures Minimize network exposure of all control systems to ensure they are not accessible from the internet. Place control networks and remote devices behind firewalls, isolated from business networks. When remote access is required, use more secure methods such as VPNs, and apply the latest security updates. Update History November 13, 2025: Initial release

Goal Reached Thanks to every supporter — we hit 100%!

Brightpick Mission Control Vulnerabilities: Missing Auth, Hardcoded Creds, Info Disclosure (CVE-2025-64307/308/309)

More from this source