CVE-2025-64309: Brightpick Ai Brightpick Mission Control / Internal Logic Control

High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days.

The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques.

Affected products

• Brightpick Ai Brightpick Mission Control / Internal Logic Control: before 1.67.0 (fixed in 1.67.0)

Published 2025-11-15. Last modified 2026-06-25.