High severity8.6NVD Advisory· Published Nov 15, 2025· Updated Apr 15, 2026

CVE-2025-64309

Description

Brightpick Mission Control discloses device telemetry, configuration, and credential information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques.

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

brightpick.ai/contact-us/nvd
github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-04.jsonnvd
www.cisa.gov/news-events/ics-advisories/icsa-25-317-04nvd

News mentions

No linked articles in our index yet.

cvss	0.559
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000