PT-2025-42662 · Restaurant Brands International · Assistant Platform

Published 2025-10-17 · Updated 2025-10-31 · CVE-2025-62649

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Restaurant Brands International (RBI) assistant platform versions through 2025-09-06

Description The Restaurant Brands International (RBI) assistant platform through 2025-09-06 utilizes client-side authentication when submitting equipment orders. This means the authentication process is handled on the user's device rather than the server, potentially allowing manipulation of the authentication request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-603

Related Identifiers

CVE-2025-62649

Affected Products

Assistant Platform

References · 12

• 🔥 https://archive.today/fMYQp · Exploit
• https://osv.dev/vulnerability/CVE-2025-62649 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62649 · Security Note
• https://web.archive.org/web/20250906134240/https:/bobdahacker.com/blog/rbi-hacked-drive-thrus · Note
• https://t.me/cveNotify/139278 · Telegram Post
• https://yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html · Note
• https://bobdahacker.com/blog/rbi-hacked-drive-thrus · Note
• https://twitter.com/CVEnew/status/1979289055528423458 · Twitter Post
• https://malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers · Note
• https://t.me/cveNotify/139294 · Telegram Post
• https://t.me/cveNotify/141174 · Telegram Post
• https://t.me/CVEtracker/35231 · Telegram Post