EUVD-2026-45903
GHSA-gxr5-ww5q-wmqx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Local low-privileged user (AV:L, PR:L) exploits a trivially discoverable world-writable ACL (AC:L) to tamper with privileged files, yielding high confidentiality/integrity and limited availability impact.
Primary rating from Vendor (0beee27a-7d8c-424f-8e46-ac453fa147e6).
CVSS VectorVendor: 0beee27a-7d8c-424f-8e46-ac453fa147e6
Lifecycle Timeline
2DescriptionCVE.org
In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to %ProgramData%\Bizerba\_connect.BRAIN or %ProgramData%\Bizerba\BCT.
Starting with _connect.BRAIN 5.06, the setup no longer executes this tool.
AnalysisAI
Local privilege escalation in Bizerba _connect.BRAIN before version 5.06 stems from its setup routine invoking LogPathConfig.exe, which strips the existing ACL on %ProgramData% and grants the built-in Everyone group full control instead of scoping permissions to the Bizerba subfolders. Any local low-privileged user can then modify files under %ProgramData% that privileged components read or execute, enabling escalation to higher privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is resolved in 5.06, which no longer runs the tool.
Technical ContextAI
The root cause is CWE-276 (Incorrect Default Permissions). On Windows, %ProgramData% (typically C:\ProgramData) is a shared machine-wide location that should be writable only by administrators/SYSTEM while allowing standard users read/execute. The affected product ships a helper, LogPathConfig.exe, run during installation to configure log paths; instead of tightening ACLs to %ProgramData%\Bizerba\_connect.BRAIN and %ProgramData%\Bizerba\BCT, it replaces the inherited ACL on the whole %ProgramData% root with a Full Control grant to Everyone. This weakens the security boundary for every application storing data there, not just Bizerba's, because any local principal can create, overwrite, or delete files - the classic pre-condition for DLL/binary planting or config tampering against services running as SYSTEM. The affected product is Bizerba _connect.BRAIN, a component in Bizerba's retail/industrial weighing and labeling ecosystem (BCT); no CPE strings were provided in the input.
RemediationAI
Vendor-released patch: 5.06 - upgrade Bizerba _connect.BRAIN to 5.06 or later, which no longer runs LogPathConfig.exe and therefore does not weaken %ProgramData% permissions. Critically, upgrading alone may not repair an already-corrupted ACL on hosts where the vulnerable installer previously ran, so on those systems administrators should manually reset permissions on %ProgramData% to the Windows default (remove the Everyone Full Control grant and restore inherited administrator/SYSTEM-only write access, scoping any needed application write access to %ProgramData%\Bizerba\_connect.BRAIN and %ProgramData%\Bizerba\BCT only) - for example via icacls to reset inheritance and re-apply the standard ProgramData ACL. The trade-off is that overly aggressive tightening could break the application's ability to write logs, so validate that the two Bizerba subfolders retain the required write access after remediation. Consult the vendor advisory for authoritative guidance: https://www.bizerba.com/downloads/global/information-security/2026/bizerba-sa-2026-0003.pdf.
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today