The vulnerability identified as CVE-2025-64309 in Brightpick AI's Brightpick Mission Control / Internal Logic Control involves unauthorized disclosure of sensitive information through WebSocket traffic. When an unauthenticated user connects to a specific URL, device telemetry, configuration, and sensitive data are exposed. The URL can be found using basic network scanning techniques, making the vulnerability accessible remotely with low attack complexity and no required privileges or user interaction. The CVSS 3.1 base score is 7.4, reflecting high confidentiality impact and scope change, but no integrity or availability impact. All versions of the product are affected. No patch or remediation details are provided in the available data.

The vulnerability leads to high confidentiality impact by exposing sensitive device telemetry and configuration data to unauthenticated remote attackers. This could allow attackers to gather intelligence about the device and its operation, potentially facilitating further attacks or unauthorized access. There is no direct impact on integrity or availability reported. The scope is changed, indicating that the vulnerability affects components beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor vendor communications for updates. Until a patch is available, restrict network access to the affected product to trusted users only and consider network-level controls to prevent unauthorized access to the specific WebSocket URL. Avoid exposing the product to untrusted networks.