CVE-2025-64309

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2025-11-15

Last updated on: 2026-06-25

Assigner: ICS-CERT

Description

The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-15

Last Modified

2026-06-25

Generated

2026-07-06

AI Q&A

2025-11-15

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64309

Affected Vendors & Products

Vendor	Product	Version / Range
brightpick	mission_control	4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-523	Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

Attack-Flow Graph

Executive Summary

This vulnerability in Brightpick Mission Control allows unauthenticated users to access device telemetry, configuration, and credential information via WebSocket traffic by connecting to a specific URL. This URL can be found using basic network scanning techniques, leading to unauthorized disclosure of sensitive information.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive device telemetry, configuration, and credential information. This exposure can be exploited by attackers to gain insights into the system, potentially leading to further attacks or unauthorized access.

Detection Guidance

This vulnerability can be detected by scanning your network for the specific unauthenticated URL that exposes device telemetry, configuration, and credential information via WebSocket traffic. Basic network scanning techniques can be used to discover this URL. Specific commands are not provided in the available information.

Mitigation Strategies

Immediate mitigation steps are not detailed in the provided information. However, since the vulnerability involves unauthenticated access to sensitive information via a WebSocket URL, restricting access to the URL, implementing authentication, and monitoring network traffic for unauthorized connections are advisable.

Hi! I’m here to help you understand CVE-2025-64309. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70