CVE-2025-62646

highpriority · track · 31EPSS 0.005 · 45 %ileEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.54% (45th) EPSS
CVSS 7.7 · high
Is it mine?
6 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · cisa_csaf_it · nvd

EPSS · scored 2026-10-27

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedassistant platformcisa_csaf_it

    Reporters state that the vulnerabilities were fixed on 2025-09-06.

02

cvss

Technical severity, 0–10. One row per scoring source.

7.7
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.7

v3.17.7highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 3.1 · impact 4
v3.15mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:Nsecondary · CISA US
v3.15mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:Nsecondary · ENISA EU
v3.15mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:Nsecondary · cve@mitre.org USexploitability 3.1 · impact 1.4
v3.17.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: partialcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-669USCWE-669US
05

affected products (6)

Products and version ranges known to be affected.

06

advisories (1)

Vendor and ecosystem advisories describing this.

  • VA-25-304-02Restaurant Brands International assistant platform multiple vulnerabilities2025-10-31csaf · cisa_csaf_itUS

    Restaurant Brands International assistant platform is used to manage restaurants owned by RBI. Multiple vulnerabilities were found in the assistant platform. The most severe vulnerabilities chained together could allow a remote, unauthenticated attacker to create an account and escalate the privileges of that account to access personally identifiable information and read/write access to store information. Reporters took down their original work, stating: "We received a DMCA copyright infringement complaint from Cyble Inc., acting on behalf of Burger King, regarding our blog post about Restaurant Brands International's drive-thru system vulnerabilities. The complaint alleges trademark infringement and claims the content 'promotes illegal activity and spreads false information.'"

07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_itnvdNVDCVE.orgMITRE
published 2025-10-17modified 2026-06-17
09

references (16)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan