The Brightpick Internal Logic Control web interface is accessible
without requiring user authentication. An unauthorized user could
exploit this interface to manipulate robot control functions, including
initiating or halting runners, assigning jobs, clearing stations, and
deploying storage totes.
Brightpick AI has not responded to requests to work with CISA to
mitigate these vulnerabilities. Users of the affected products are
encouraged to contact Brightpick AI https://brightpick.ai/contact-us/ for additional information.