CVE-2025-64309
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-15

Last updated on: 2025-11-15

Assigner: ICS-CERT

Description
Brightpick Mission Control discloses device telemetry, configuration, and credential information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-15
Last Modified
2025-11-15
Generated
2026-05-07
AI Q&A
2025-11-15
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
brightpick mission_control 4.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-523 Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in Brightpick Mission Control allows unauthenticated users to access device telemetry, configuration, and credential information via WebSocket traffic by connecting to a specific URL. This URL can be found using basic network scanning techniques, leading to unauthorized disclosure of sensitive information.


How can this vulnerability impact me? :

The vulnerability can lead to unauthorized disclosure of sensitive device telemetry, configuration, and credential information. This exposure can be exploited by attackers to gain insights into the system, potentially leading to further attacks or unauthorized access.


How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by scanning your network for the specific unauthenticated URL that exposes device telemetry, configuration, and credential information via WebSocket traffic. Basic network scanning techniques can be used to discover this URL. Specific commands are not provided in the available information.


What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation steps are not detailed in the provided information. However, since the vulnerability involves unauthenticated access to sensitive information via a WebSocket URL, restricting access to the URL, implementing authentication, and monitoring network traffic for unauthorized connections are advisable.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart