CVE-2026-16247
Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN
- State
- Published
- Severity
- 7.3 High
- Published
- Jul 20, 2026
- Updated
- Jul 20, 2026
- Reserved
- Jul 20, 2026
Description
In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to %ProgramData%\Bizerba\_connect.BRAIN or %ProgramData%\Bizerba\BCT.
Starting with _connect.BRAIN 5.06, the setup no longer executes this tool.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.3 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L | bizerba |
Weaknesses
- CWE-276 Incorrect default permissions
Affected Products
| Product | Versions |
|---|---|
_connect.BRAINBizerba SE & Co. KG |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.