CVE-2025-64307

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit this interface to manipulate robot control functions, including initiating or halting runners, assigning jobs, clearing stations, and deploying storage totes.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
Brightpick AI	Brightpick Mission Control / Internal Logic Control	< 1.67.0

References

Timeline

Published: Nov 15, 2025
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-643086.5The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documen CVE-2025-643097.4The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users whe CVE-2025-64316.5When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker cou CVE-2025-643109.8EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrativ CVE-2025-643115.5Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentia CVE-2025-643127.5Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect service con CVE-2025-643135.5Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-643145.5Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability may affect confident CVE-2025-643157.1Configuration defect vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect app data CVE-2025-643185.3Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Write CVE-2025-643195.3Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeab CVE-2025-64328.6When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS prox