Skip to content
OpenAdvisories
High ICSA-25-317-04 3 CVEs

Brightpick Mission Control / Internal Logic Control (Update A)

Published Nov 13, 2025 · Updated Jun 23, 2026 · Revision 2

Vendor: Brightpick AI Product: Brightpick Mission Control / Internal Logic Control

Summary

Successful exploitation of these vulnerabilities could result in the exposure of sensitive information and the manipulation of critical functions by an attacker.

Vulnerabilities 3

  • High 7.4
    CVE-2025-64309

    Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials

    The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques.

    Brightpick AI Brightpick Mission Control / Internal Logic Control
  • Medium 6.5
    CVE-2025-64307

    Brightpick Mission Control / Internal Logic Control Missing Authentication for Critical Function

    The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit this interface to manipulate robot control functions, including initiating or halting runners, assigning jobs, clearing…

    Brightpick AI Brightpick Mission Control / Internal Logic Control
  • Medium 6.5
    CVE-2025-64308

    Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials

    The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal.

    Brightpick AI Brightpick Mission Control / Internal Logic Control

Revision history

  1. #2

    Update A - Updated vulnerability descriptions and mitigations

  2. #1

    Initial Publication

References