CVE-2025-64308

MEDIUM

Brightpick Mission Control - Info Disclosure

Title source: llm

Description

The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal.

References (3)

Core 3

Core References

Various Sources

https://brightpick.ai/contact-us/

Third Party Advisory, US Government Resource

https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-04

Various Sources

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-04.json

View Writeup ZIP pw:eip

Scores

CVSS v3 6.5

EPSS 0.0021

EPSS Percentile 11.0%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-523

Status published

Products (3)

Brightpick AI/Brightpick Mission Control / Internal Logic Control < 1.67.0

Brightpick AI/Brightpick Mission Control / Internal Logic Control 1.67.0

Brightpick AI/Brightpick Mission Control / Internal Logic Control All versions

Published Nov 15, 2025

Tracked Since Feb 18, 2026