CVE-2025-64308CWE-523

CVE-2025-64308

Medium · published November 15, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
13.0
In the wild
Unconfirmed
What it is

The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00230 · 13.0th percentile
Weakness
CWE-523 · Unprotected Transport of Credentials
Published
2025-11-15T05:15Z
References (3)
https://brightpick.ai/contact-us/ · [email protected]https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-04.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-04 · [email protected]
EPSS history
Timeline
  • 14 NOV 23:38Z
    Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials
    cvelistv5