CVE-2025-64309CWE-523

CVE-2025-64309

High · published November 15, 2025

CVSS v3.1
7.4
EPSS
0%
Percentile
12.3
In the wild
Unconfirmed
What it is

The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00224 · 12.3th percentile
Weakness
CWE-523 · Unprotected Transport of Credentials
Published
2025-11-15T05:15Z
References (3)
https://brightpick.ai/contact-us/ · [email protected]https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-04.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-04 · [email protected]
EPSS history
Timeline
  • 14 NOV 23:41Z
    Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials
    cvelistv5