Vulnerability · Published Nov 14, 2025 · Assigned by icscert
CVE-2025-64307Brightpick Mission Control / Internal Logic Control Missing Authentication for Critical Function
Medium 6.5
In plain English
A medium-severity missing authentication in Brightpick Mission Control / Internal Logic Control from Brightpick AI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 84.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit this interface to manipulate robot control functions, including initiating or halting runners, assigning jobs, clearing stations, and deploying storage totes.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Brightpick AI | Brightpick Mission Control / Internal Logic Control | 0 – before 1.67.0 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N