anonhaven

CVE-2026-112250

MEDIUM CVSS 3.1: 4.4 EPSS 0.18%
Updated Oct 26, 2026
Bizerba Se & Co. Kg
Parameter Value
CVSS 4.4 (MEDIUM)
Type CWE-532
Vendor Bizerba Se & Co. Kg
Public PoC No

A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the password of a Windows service account may be written in cleartext to a setup log file. The issue occurs when Microsoft SQL Server access is configured using Integrated Security and the Windows account intended to run the BRAIN2 MainService is specified during execution of the BRAIN2 installation wizard.

The setup log file is stored in the temporary directory of the Windows administrator performing the installation. This directory is not accessible to standard Windows users and can generally only be accessed by users with administrative privileges. Successful exploitation could result in the disclosure of credentials belonging to the configured BRAIN2 service account.

Attack Parameters

Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-532

Vulnerable Products

bizerba se & co. kg:brain2

References 1

https://www.bizerba.com/downloads/global/information-security/2026/bizerba-sa-2…
0beee27a-7d8c-424f-8e46-ac453fa147e6
Share Post Share Share Share