CVE-2025-64307CWE-306

CVE-2025-64307

Medium · published November 15, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
15.0
In the wild
Unconfirmed
What it is

The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit this interface to manipulate robot control functions, including initiating or halting runners, assigning jobs, clearing stations, and deploying storage totes.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00246 · 15.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-11-15T05:15Z
References (3)
https://brightpick.ai/contact-us/ · [email protected]https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-04.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-04 · [email protected]
EPSS history
Timeline
  • 14 NOV 23:34Z
    Brightpick Mission Control / Internal Logic Control Missing Authentication for Critical Function
    cvelistv5