The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users…
icscert·CWE-523·Published 2025-11-14
The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques.
The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques.
Brightpick Mission Control revela telemetría del dispositivo, configuración e información de credenciales a través del tráfico de WebSocket a usuarios no autenticados cuando se conectan a una URL específica. La URL no autenticada puede ser descubierta mediante técnicas básicas de escaneo de red.
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 3.1 | Primary | cve.org | 7.4 | — | — | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| 3.1 | Secondary | NVD | 7.4 | 2.8 | 4.0 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| 4.0 | Primary | cve.org | 6.0 | — | — | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N |
| 4.0 | Secondary | ENISA EUVD | 6.0 | — | — | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N |
| 4.0 | Secondary | NVD | 6.0 | — | — | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |