VULNERABILITY INTELLIGENCE
CVE-2025-64307
CVSS score6.5 MEDIUM
EPSS probability0.25%
CISA KEVNot currently listed
Published2025-11-15
Last modified2026-10-07
CVSS vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit this interface to manipulate robot control functions, including initiating or halting runners, assigning jobs, clearing stations, and deploying storage totes.
Weakness classification
- ics-cert@hq.dhs.gov: CWE-306