EUVD-2025-18870CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3Description
On a client with a non-admin user, a script can be integrated into a report. The reports could later be executed on the BRAIN2 server with administrator rights.
Analysis
CVE-2025-6512 is a critical privilege escalation vulnerability in BRAIN2 where unauthenticated attackers can inject malicious scripts into reports on non-admin client systems, which are then executed with administrator privileges on the BRAIN2 server. This represents a complete system compromise with CVSS 10.0 severity, affecting all users regardless of their local privilege level. No authentication is required to exploit this vulnerability, making it immediately exploitable in network environments.
Technical Context
This vulnerability is rooted in CWE-94 (Improper Control of Generation of Code - Code Injection), where the BRAIN2 application fails to properly sanitize or validate script content embedded in report files before execution. The attack vector is network-based with no interaction required, indicating the vulnerability likely exists in a report processing or import mechanism accessible over the network. The vulnerability chain involves: (1) a non-admin user or external attacker crafting a malicious report file containing executable code, (2) integration of this script into the BRAIN2 reporting system, and (3) subsequent execution of the report on the BRAIN2 server under administrative context without proper validation. The root cause is insufficient input validation and improper privilege separation between report creation/modification contexts and report execution contexts.
Affected Products
BRAIN2 server and client installations - specific versions not provided in vulnerability description. The vulnerability affects: (1) BRAIN2 client instances allowing report creation/modification by non-administrative users, and (2) BRAIN2 server instances processing and executing reports. The vulnerability bypasses normal privilege boundaries, affecting all deployments regardless of RBAC configuration. Without CVE reference data containing CPE strings or vendor advisories, specific version ranges cannot be definitively stated; however, organizations running any BRAIN2 installation should assume vulnerability until vendor confirmation of patched versions.
Remediation
Immediate actions: (1) Restrict network access to BRAIN2 report processing services using network segmentation and firewall rules, allowing only trusted sources. (2) Disable report execution features if not critical to operations until patching is available. (3) Implement strict input validation and sanitization for all report file uploads, rejecting files with embedded scripts. (4) Apply the latest BRAIN2 security patches from the vendor (contact BRAIN2 vendor for CVE-2025-6512 specific patch availability and version numbers). (5) Review and restrict report creation permissions to trusted administrative users only. (6) Implement execution policies preventing script execution in report contexts, or execute reports in isolated/sandboxed environments with minimal privileges.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today