CVE-2025-64309 - CVE House
Back to Database
Status published Medium CVE-2025-64309

Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials

Vulnerability Description

The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64309

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Souvik Kandar reported these vulnerabilities to CISA.

References

More from Brightpick AI

View All →
CVE-2025-64308
Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials
High 7.1
CVE-2025-64307
Brightpick Mission Control / Internal Logic Control Missing Authentication for Critical Function
High 7.1

Affected Vendor

Brightpick AI

View all reports →

Affected Software

Brightpick Mission Control / Internal Logic Control
Vulnerable Versions:
0, 1.67.0

Timeline

Official Publish: November 14th, 2025
Last Modified: June 25th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-523

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.