RBI Assistant Platform CVE-2025-62651

No vendor-released patch or fixed version is identified in the available data, so remediation must be compensating-control driven. The primary action is to enforce server-side authentication and authorization on the bathroom rating endpoint - require a valid session/token and an explicit role check before accepting any read or write - and to place the entire assistant API behind an authenticated gateway or API-management layer rather than exposing endpoints directly to the internet. Where the endpoint cannot be fixed immediately, block or rate-limit external access to the bathroom rating path at the WAF/reverse proxy (side effect: legitimate in-store or app-initiated rating submissions from the same path will also be blocked, so allow-list trusted source ranges if the feature must remain live), and remove the platform from direct internet exposure via network segmentation or VPN-only access for management and assistant interfaces (side effect: remote drive-thru/franchise management tooling that depends on direct connectivity may break and will need an alternate access path). Because exploit code is publicly available, add monitoring and alerting on anomalous or unauthenticated requests to the bathroom rating endpoint, and review logs for prior tampering. Track vendor statements through the referenced advisories at https://bobdahacker.com/blog/rbi-hacked-drive-thrus/ and the Malwarebytes write-up for any future patch or official mitigation guidance; given the low impact (integrity-only, single feature) and low EPSS score, this should be scheduled as routine rather than emergency remediation.