_connect.BRAIN EUVD-2026-45903

Requires a vulnerable install of Bizerba _connect.BRAIN prior to 5.06 where the setup executed LogPathConfig.exe, leaving %ProgramData% with an ACL granting the built-in Everyone group Full Control. The attacker must already have local interactive or authenticated access to the host as any low-privileged user (matching CVSS PR:L, AV:L). Actual escalation additionally depends on the presence of a higher-privileged process (service, scheduled task, or installer running as SYSTEM/admin) that reads or executes a file located under the world-writable %ProgramData% path - this is the concrete condition that turns the weak ACL into code execution. Limiting factors: exploitation is local-only (not remotely reachable), is neutralized on systems patched to 5.06, and requires that the flawed installer actually ran on the host; hosts where the ACL has since been reset are not exploitable.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, base 7.3) describes a locally-exploitable, low-complexity flaw requiring an existing low-privileged foothold, with high confidentiality/integrity impact and low availability impact - consistent with a privilege-escalation primitive rather than remote compromise. No EPSS score, KEV entry, POC, or SSVC decision data was supplied, so exploitation-probability and automatability signals are effectively unknown; absence of these is not evidence of low risk, but also nothing here indicates active or widespread exploitation. Because the flaw grants Everyone full control over the shared %ProgramData% root, the practical blast radius is broader than the single product: it lowers the bar for local escalation on any host where the vulnerable installer ran. Realistic priority is moderate - genuinely dangerous where the software is deployed and untrusted local users exist, but gated behind requiring local access, so it is not an internet-facing emergency.

A standard (non-administrative) user logged into a system running _connect.BRAIN below 5.06 discovers that Everyone has full control over %ProgramData%, then plants or overwrites a DLL, executable, or configuration file that a service or scheduled task running as SYSTEM later loads. When the privileged process executes the attacker-controlled file, the attacker gains SYSTEM-level code execution. No public exploit code is identified, but the technique is a well-understood local privilege-escalation pattern requiring only local access.