Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2025-64307

Brightpick Mission Control / Internal Logic Control Missing Authentication for Critical Function

High7.1EPSS 0.25%
Published
Updated
Reserved
Assigned by
icscert

Description

The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit this interface to manipulate robot control functions, including initiating or halting runners, assigning jobs, clearing stations, and deploying storage totes.

Scores

CVSS scores of CVE-2025-64307, by who scored it
Scored byCVSSScoreVector
icscertCNA (assigner)4.0High7.1CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
icscertCNA (assigner)3.1Medium6.5CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVDNVD · Deferred4.0High7.1CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.25% · top 84% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.

Weakness

Affected products

What to do

Solution: Brightpick AI has updated their backend in Mission Control to release 1.67.0 to mitigate these vulnerabilities as of February 04, 2026. Users running Mission Control 1.67.0 or later are mitigated.

Solution: Brightpick has introduced a reverse-proxy authentication layer inline between the public load balancer and the internal service. This vendor fix has been applied to all deployed instances.

Workaround: Users of the affected products are encouraged to contact Brightpick AI https://brightpick.ai/contact-us/ for additional information.

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-64307 badge
[![CVE-2025-64307](https://trackcve.app/badge/CVE-2025-64307.svg)](https://trackcve.app/cve/CVE-2025-64307)

Record last updated .