CVE-2025-64309 HIGH

CVE-2025-64309: Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials

Vendor Brightpick Ai
Product Brightpick Mission Control / Internal Logic Control
Weakness CWE-523
Published November 14, 2025
Last update November 17, 2025
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

Brightpick Mission Control discloses device telemetry, configuration, and credential information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques.

Key dates

02Disclosure timeline

November 14, 2025 CVE published
November 17, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-1102 Jberet: jberet-core logging database credentials CVE-2022-31805 Insecure transmission of credentials CVE-2024-4188 Security vulnerability exists in Documentum server cloud releases that could allow access to sensitive information which can impact system Operation. CVE-2026-8673 Password re-initialization mechanism sends passwords in plain text CVE-2025-64308 Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials