Vulnerabilities

TI-2025-39746 CVE-2025-64309 · GHSA-7j94-8gxx-fvqg

Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials

LOW 32

The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users when they connect to a specific URL.

CVSS 4.0MEDIUM 6.0 Adjacent network No auth No interaction EPSS 0.00224 Published 2025-11-14 Fixed in 1.67.0 CWE-523

TI-2025-39745 CVE-2025-64308 · GHSA-wj9f-8875-4rpw

Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials

LOW 37

The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal.

CVSS 4.0HIGH 7.1 Adjacent network No auth No interaction EPSS 0.0023 Published 2025-11-14 Fixed in 1.67.0 CWE-523

TI-2025-39744 CVE-2025-64307 · GHSA-hhwr-hq3f-7f8r

Brightpick Mission Control / Internal Logic Control Missing Authentication for Critical Function

LOW 31

The Brightpick Internal Logic Control web interface is accessible without requiring user authentication.

CVSS 4.0HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00246 Published 2025-11-14 Fixed in 1.67.0 CWE-306

Vulnerabilities

Filters

Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials

Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials

Brightpick Mission Control / Internal Logic Control Missing Authentication for Critical Function