Windows CVE-2025-6513

This vulnerability presents exceptionally high real-world risk despite limited publicly available exploit data. The CVSS 9.3 score accurately reflects the severity: AV:L (local attack vector, but standard user access is trivial in enterprise environments with shared workstations), AC:L (no complexity—straightforward file reading and decryption), PR:N (no privilege escalation prerequisites), and S:C/C:H/I:H/A:H (crosses security boundaries with complete confidentiality, integrity, and availability impact). The absence of user interaction (UI:N) makes this automatable. The true risk is elevated in environments where: (1) BRAIN2 connects to critical databases, (2) multiple users access shared systems, (3) the application runs with elevated privileges, or (4) the database account has broad permissions. Without confirmed KEV/CISA inclusion, active exploitation data, or public PoC details, the immediate threat may be lower than CVSS suggests, but the vulnerability is trivial to exploit locally and should be prioritized in any environment using BRAIN2.

An attacker with local access to a Windows system running BRAIN2 (e.g., standard domain user on a shared workstation, contractor with temporary access, or insider threat) navigates to the BRAIN2 application directory, locates the configuration file (typically named config.xml, app.config, settings.ini, or similar), reads it directly (no privilege escalation needed), and extracts the database connection string. If credentials are encrypted, the attacker examines the encryption key (likely hardcoded in the application binary or stored nearby) and decrypts the credentials using standard tools or custom scripts. With the database username, password, and server address now compromised, the attacker connects directly to the backend database server, potentially exfiltrating sensitive data, modifying records, or establishing persistence. In a high-impact scenario, if the BRAIN2 service runs with elevated privileges or the database account has administrative rights, the attacker could escalate to full system compromise or lateral movement across the network. Attack complexity is minimal (minutes to execute) and requires no special tools beyond file system access and basic encryption knowledge.