Executive brief
Brightpick Mission Control, a software platform used to manage autonomous warehouse robots, contains a security flaw that leaks sensitive operational data. An unauthorized person on the same network can access device telemetry, system configurations, and other private information by connecting to a specific web address. This could allow an attacker to gain detailed insights into warehouse operations or gather credentials to further compromise the system.
Technical details
A vulnerability in Brightpick Mission Control / Internal Logic Control (versions prior to 1.67.0) allows for the unprotected transport of sensitive information (CWE-523). The application discloses device telemetry, system configuration, and credential information via WebSocket traffic to unauthenticated users who connect to a specific endpoint. This URL can be identified through basic network scanning. An attacker with adjacent network access can exploit this to intercept sensitive data without any prior authentication or user interaction. The vendor has addressed this in version 1.67.0 by updating the backend and implementing a reverse-proxy authentication layer.
Affected products
- Brightpick AI Mission Control / Internal Logic Control < 1.67.0
Timeline
- 2025-11-14: advisory: Initial NVD/ICS-CERT publication
- 2026-02-04: patched: Vendor released version 1.67.0 to mitigate the issue
- 2026-06-23: other: CISA advisory updated