TI-2026-80307 Aliases CVE-2026-112250 GHSA-p6ch-jxpp-q2jv

Cleartext service account password in BRAIN2 setup log files

LOW 20CWE-532Published 2026-10-26 · Updated 2026-10-26

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

Bizerba SE & Co. KG BRAIN2 versions up to and including 3.09 write the password of a Windows service account in cleartext to a setup log file (CWE-532). This occurs when Microsoft SQL Server access uses Integrated Security and the account for the BRAIN2 MainService is specified in the installation wizard. A local attacker with high privileges can read the credentials from the log file, which is stored in the temporary directory of the administrator who performed the installation.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the password of a Windows service account may be written in cleartext to a setup log file. The issue occurs when Microsoft SQL Server access is configured using Integrated Security and the Windows account intended to run the BRAIN2 MainService is specified during execution of the BRAIN2 installation wizard. The setup log file is stored in the temporary directory of the Windows administrator performing the installation. This directory is not accessible to standard Windows users and can generally only be accessed by users with administrative privileges. Successful exploitation could result in the disclosure of credentials belonging to the configured BRAIN2 service account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00173 6th percentileScored 2026-11-07

Fix Fixed BRAIN2 (Bizerba SE & Co. KG): 3.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Bizerba SE & Co. KG	BRAIN2	0.0 to before 3.10	3.10	Patch available	CNA

BRAIN2 VendorBizerba SE & Co. KG Affected 0.0 to before 3.10 Fixed in 3.10 Patch available CNA

Remediation

Bizerba lists BRAIN2 version 3.10 as the fixed version. Update BRAIN2 to version 3.10.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA BRAIN2 (Bizerba SE & Co. KG) Fixed in 3.10

Timeline

2026-10-26 Threatist record created from CVE-2026-112250
2026-10-26 CISA SSVC decision points changed
2026-10-27 Alias added: GHSA-p6ch-jxpp-q2jv

References

Other 1

https://www.bizerba.com/downloads/global/information-security/2026/bizerba-sa-2026-0004.pdf

TI-2025-05912 Scripts within reports executable on BRAIN2 Server CVSS 3.1CRITICAL 10.0
TI-2025-05913 BRAIN2 Configuration file for database access not sufficiently secured CVSS 3.1CRITICAL 9.3
TI-2026-13585 Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN CVSS 3.1HIGH 7.3
TI-2026-13584 Insecure permission assignment due to execution of LogPathConfig.exe during setup CVSS 3.1HIGH 7.3
TI-2025-02464 Denial of service in Bizerba SE & Co. KG Product family GLx and CWx CVSS 3.1MEDIUM 6.5
TI-2025-02463 Unrestricted Fileupload CVSS 3.1MEDIUM 6.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences