CVE-2026-16247 PUBLISHED

Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN

Assigner: bizerba
Reserved: 20.07.2026 Published: 20.07.2026 Updated: 20.07.2026

In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to %ProgramData%\Bizerba_connect.BRAIN or %ProgramData%\Bizerba\BCT.

Starting with _connect.BRAIN 5.06, the setup no longer executes this tool.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS Score: 7.3

Product Status

Vendor Bizerba SE & Co. KG
Product _connect.BRAIN
Versions Default: affected
  • Version >5.06 is affected

Workarounds

An automatic correction is not possible, as restoring permissions on %ProgramData% may affect other installed software.

A Windows administrator can reduce the risk by:

  • reviewing and restoring required permissions on %ProgramData%, and

  • removing full control permissions for Everyone, and

  • assigning full control permissions for Everyone specifically to %ProgramData%\Bizerba_connect.BRAIN or %ProgramData%\Bizerba\BCT.

Solutions

  • Upgrade to _connect.BRAIN 5.06 or later

  • Important:

    An update does not restore previously overwritten permissions on %ProgramData%.

    Permissions must be manually reviewed and corrected by a Windows administrator.

Only a fresh installation of _connect.BRAIN 5.06 or later ensures that the issue does not occur during setup.

References

Problem Types

  • CWE-276 Incorrect default permissions CWE