Insecure permission assignment due to execution of LogPathConfig.exe during setup
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows group Everyone is granted full control over %ProgramData% instead of being restricted to %ProgramData%\Bizerba\BRAIN2\. Starting with BRAIN2 3.09, the setup no longer executes this tool. However, the optional component Bizerba ScriptService still executes it. Bizerba ScriptService is being deprecated and will no longer be included starting with BRAIN2 version 3.11.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Bizerba SE & Co. KG | BRAIN2 | >3.09 and later | — | No fix listed | CNA |
- BRAIN2 VendorBizerba SE & Co. KG Affected >3.09 and later Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-16246
- 2026-10-03 Alias added: GHSA-r977-vhwm-4c47
References
More Bizerba SE & Co. KG vulnerabilities
- TI-2025-05912 Scripts within reports executable on BRAIN2 Server CVSS 3.1CRITICAL 10.0
- TI-2025-05913 BRAIN2 Configuration file for database access not sufficiently secured CVSS 3.1CRITICAL 9.3
- TI-2026-13585 Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN CVSS 3.1HIGH 7.3
- TI-2025-02464 Denial of service in Bizerba SE & Co. KG Product family GLx and CWx CVSS 3.1MEDIUM 6.5
- TI-2025-02463 Unrestricted Fileupload CVSS 3.1MEDIUM 6.6
- TI-2026-80307 Cleartext service account password in BRAIN2 setup log files CVSS 3.1MEDIUM 4.4
Sources
- CVE-2026-16246 · CVE Program
- CVE-2026-16246 · NVD
- FIRST EPSS
- GHSA-r977-vhwm-4c47 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences