{"id":"CVE-2026-16247","state":"PUBLISHED","title":"Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN","description":"In _connect.BRAIN versions prior to 5.06,\nthe application LogPathConfig.exe is executed during setup. During this\nprocess, existing permissions on %ProgramData% are deleted and replaced,\ngranting the Windows group Everyone full control instead of restricting\naccess to %ProgramData%\\Bizerba\\_connect.BRAIN or %ProgramData%\\Bizerba\\BCT.\n\n\n\n\n\n\n\n\n\nStarting with _connect.BRAIN 5.06,\nthe setup no longer executes this tool.","publishedAt":"2026-07-20T11:54:37.566Z","updatedAt":"2026-07-20T12:55:40.988Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","source":"bizerba"},"assigner":"bizerba","products":["Bizerba SE & Co. KG _connect.BRAIN"],"affected":[{"vendor":"Bizerba SE & Co. KG","product":"_connect.BRAIN","defaultStatus":"affected","versions":[{"version":">5.06","status":"affected"}],"platforms":["Windows"]}],"references":["https://www.bizerba.com/downloads/global/information-security/2026/bizerba-sa-2026-0003.pdf"],"weaknesses":["CWE-276"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/16xxx/CVE-2026-16247.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-16247","state":"PUBLISHED","datePublished":"2026-07-20T11:54:37.566Z","dateUpdated":"2026-07-20T12:55:40.988Z","assignerShortName":"bizerba","assignerOrgId":"0beee27a-7d8c-424f-8e46-ac453fa147e6","dateReserved":"2026-07-20T07:04:24.445Z"},"containers":{"cna":{"title":"Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN","descriptions":[{"lang":"en","value":"In _connect.BRAIN versions prior to 5.06,\nthe application LogPathConfig.exe is executed during setup. During this\nprocess, existing permissions on %ProgramData% are deleted and replaced,\ngranting the Windows group Everyone full control instead of restricting\naccess to %ProgramData%\\Bizerba\\_connect.BRAIN or %ProgramData%\\Bizerba\\BCT.\n\n\n\n\n\n\n\n\n\nStarting with _connect.BRAIN 5.06,\nthe setup no longer executes this tool."}],"affected":[{"vendor":"Bizerba SE & Co. KG","product":"_connect.BRAIN","defaultStatus":"affected","versions":[{"version":">5.06","status":"affected"}],"platforms":["Windows"]}],"references":[{"url":"https://www.bizerba.com/downloads/global/information-security/2026/bizerba-sa-2026-0003.pdf"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW","baseSeverity":"HIGH","baseScore":7.3,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-276","lang":"en","description":"CWE-276 Incorrect default permissions","type":"CWE"}]}],"providerMetadata":{"shortName":"bizerba","orgId":"0beee27a-7d8c-424f-8e46-ac453fa147e6","dateUpdated":"2026-07-20T11:54:37.566Z"},"workarounds":[{"lang":"en","value":"An automatic correction is not possible, as\nrestoring permissions on %ProgramData% may affect other installed\nsoftware.\n\n\n\nA Windows administrator can reduce the risk\nby:\n\n\n\n\n\n\n\n\n\n\n   *  reviewing and restoring required permissions on %ProgramData%,\n     and\n\n   *  removing full control permissions for Everyone, and\n\n   *  assigning full control permissions for Everyone\n     specifically to %ProgramData%\\Bizerba\\_connect.BRAIN or %ProgramData%\\Bizerba\\BCT.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>An automatic correction is not possible, as\nrestoring permissions on <b>%ProgramData%</b> may affect other installed\nsoftware.</p><p>A Windows administrator can reduce the risk\nby:</p><p>\n\n\n\n</p><ul>\n <li>reviewing and restoring required permissions on <b>%ProgramData%</b>,\n     and</li>\n <li>removing full control permissions for <b>Everyone</b>, and</li>\n <li>assigning full control permissions for <b>Everyone</b>\n     specifically to <b>%ProgramData%\\Bizerba\\_connect.BRAIN</b> or<b> %ProgramData%\\Bizerba\\BCT</b>.</li>\n</ul><ul>\n</ul>"}]}],"solutions":[{"lang":"en","value":"*  Upgrade to _connect.BRAIN 5.06 or later\n\n   *  Important:\n\n     An update does not restore previously overwritten permissions on %ProgramData%.\n\n     Permissions must be manually reviewed and corrected by a Windows\n     administrator.\n\n\n\n\n\nOnly a fresh installation of _connect.BRAIN\n5.06 or later ensures that the issue does not occur during setup.","supportingMedia":[{"type":"text/html","base64":false,"value":"<ul>\n <li>Upgrade to <b>_connect.BRAIN 5.06 or later</b></li>\n <li><b>Important:</b><br>\n     An update does not restore previously overwritten permissions on <b>%ProgramData%</b>.<br>\n     Permissions must be manually reviewed and corrected by a Windows\n     administrator.</li>\n</ul>\n\nOnly a <b>fresh installation</b> of <b>_connect.BRAIN\n5.06 or later</b> ensures that the issue does not occur during setup."}]}],"timeline":[{"time":"2026-05-07T22:00:00.000Z","lang":"en","value":"Release of _connect.BRAIN"}],"source":{"advisory":"BIZERBA-SA-2026-0003","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.4"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-20T12:55:33.275252Z","id":"CVE-2026-16247","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-20T12:55:40.988Z"}}]}}}