BRAIN2 Configuration file for database access not sufficiently secured
Priority MEDIUM 41CWE-260Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Standard Windows users can access the configuration file for database access of the BRAIN2 application and decrypt it.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00166 5th percentileScored 2026-11-07
Fix Fixed BRAIN2 (Bizerba SE & Co. KG): 3.06
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Bizerba SE & Co. KG | BRAIN2 | 0.0 to before 3.06 | 3.06 | Patch available | CNA |
- BRAIN2 VendorBizerba SE & Co. KG Affected 0.0 to before 3.06 Fixed in 3.06 Patch available CNA
Remediation
- Fix · CNA BRAIN2 (Bizerba SE & Co. KG) Fixed in 3.06
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Bizerba SE & Co. KG BRAIN2 3.06
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2025-05912 Scripts within reports executable on BRAIN2 ServerPriority MEDIUM 50
Timeline
- 2026-10-02 Threatist record created from CVE-2025-6513
- 2026-10-03 Alias added: GHSA-7f9h-3v62-fx27
References
More Bizerba SE & Co. KG vulnerabilities
- TI-2025-05912 Scripts within reports executable on BRAIN2 Server CVSS 3.1CRITICAL 10.0
- TI-2026-13585 Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN CVSS 3.1HIGH 7.3
- TI-2026-13584 Insecure permission assignment due to execution of LogPathConfig.exe during setup CVSS 3.1HIGH 7.3
- TI-2025-02464 Denial of service in Bizerba SE & Co. KG Product family GLx and CWx CVSS 3.1MEDIUM 6.5
- TI-2025-02463 Unrestricted Fileupload CVSS 3.1MEDIUM 6.6
- TI-2026-80307 Cleartext service account password in BRAIN2 setup log files CVSS 3.1MEDIUM 4.4
Sources
- CVE-2025-6513 · CVE Program
- CVE-2025-6513 · NVD
- FIRST EPSS
- GHSA-7f9h-3v62-fx27 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences