PT-2025-47029 · Unknown · Brightpick

Published 2025-11-14 · Updated 2025-11-15 · CVE-2025-64307

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Brightpick versions (affected versions not specified)

Description The Brightpick Internal Logic Control web interface is accessible without user authentication. This allows an unauthorized user to manipulate robot control functions. These functions include initiating or halting runners, assigning jobs, clearing stations, and deploying storage totes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-64307

Affected Products

Brightpick

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-64307 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-04.json · Note
• https://twitter.com/VulmonFeeds/status/1989506926816768175 · Twitter Post
• https://twitter.com/CVEnew/status/1989481094794645807 · Twitter Post
• https://t.me/CVEtracker/37392 · Telegram Post
• https://t.me/cveNotify/142896 · Telegram Post
• https://brightpick.ai/contact-us · Note
• https://cisa.gov/news-events/ics-advisories/icsa-25-317-04 · Note