CVE-2025-62648

mediumpriority · track · 23OT risk · elevatedEPSS 0.004 · 33 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.39% (33rd) EPSS

CVSS 5.8 · medium

Is it mine?

6 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cisa_csaf_it · nvd

EPSS · scored 2026-10-27

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedassistant platformcisa_csaf_it
Reporters state that the vulnerabilities were fixed on 2025-09-06.

cvss

Technical severity, 0–10. One row per scoring source.

6.4

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.8mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 1.4

v3.16.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:Lsecondary · CISA US

v3.16.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:Lsecondary · ENISA EU

v3.16.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:Lsecondary · cve@mitre.org USexploitability 3.1 · impact 2.7

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-863USCWE-863US

affected products (6)

Products and version ranges known to be affected.

Restaurant Brands International assistant platform 2025-09-06all versionsfixedcisa_csaf_itUS
Restaurant Brands International assistant platform <2025-09-06all versionscisa_csaf_itUS
Restaurant Brands International assistant platformall versionsfixedcisa_csaf_itUS
Restaurant Brands International assistant platform< 2025-09-06cisa_csaf_itUS
Restaurant Brands International assistant platform≤ 0 ≤2025-09-06enisa_euvdEU
rbi restaurant brands international assistant≤ 2025-09-06nvdUScpe:2.3:a:rbi:restaurant_brands_international_assistant:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

VA-25-304-02Restaurant Brands International assistant platform multiple vulnerabilities2025-10-31csaf · cisa_csaf_itUS
Restaurant Brands International assistant platform is used to manage restaurants owned by RBI. Multiple vulnerabilities were found in the assistant platform. The most severe vulnerabilities chained together could allow a remote, unauthenticated attacker to create an account and escalate the privileges of that account to access personally identifiable information and read/write access to store information. Reporters took down their original work, stating: "We received a DMCA copyright infringement complaint from Cyble Inc., acting on behalf of Burger King, regarding our blog post about Restaurant Brands International's drive-thru system vulnerabilities. The complaint alleges trademark infringement and claims the content 'promotes illegal activity and spreads false information.'"

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cisa_csaf_it nvd NVD CVE.org MITRE

published 2025-10-17modified 2026-06-17

references (16)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan