CVE-2026-16247 in _connect.BRAIN
Summary
by MITRE • 07/20/2026
In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to %ProgramData%\Bizerba\_connect.BRAIN or %ProgramData%\Bizerba\BCT.
Starting with _connect.BRAIN 5.06, the setup no longer executes this tool.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability described in this CVE relates to improper privilege management during the installation process of Bizerba _connect.BRAIN software versions prior to 5.06. The core issue manifests through the LogPathConfig.exe application which is executed as part of the setup routine, creating a significant security weakness by altering system permissions inappropriately. During the installation process, this executable systematically removes existing permissions on the %ProgramData% directory structure and replaces them with overly permissive settings that grant the Windows group Everyone full control over the affected directories.
This permission modification creates a persistent security exposure that violates fundamental security principles of least privilege and access control. The vulnerability specifically affects the %ProgramData%\Bizerba\_connect.BRAIN and %ProgramData%\Bizerba\BCT directory paths where the application stores its data and configuration files. By granting Everyone full control, any local user or process on the system can modify, delete, or execute files within these directories, creating potential attack vectors for privilege escalation, data tampering, and unauthorized system access.
The operational impact of this vulnerability extends beyond simple permission misconfiguration as it fundamentally undermines the security posture of systems running affected software versions. Attackers could potentially leverage this weakness to inject malicious code into the application's data directories, modify configuration files to redirect system behavior, or escalate privileges by exploiting the overly permissive permissions. This vulnerability aligns with CWE-276 which addresses improper file permissions and represents a classic example of insecure default configurations that persist beyond the installation process.
The security implications are particularly concerning in enterprise environments where multiple users may have access to systems running this software, as it creates opportunities for lateral movement and persistent access. The vulnerability also demonstrates poor adherence to security best practices outlined in various cybersecurity frameworks including those referenced in MITRE ATT&CK framework under privilege escalation techniques. The change implemented in version 5.06 that eliminates the execution of LogPathConfig.exe during setup represents a crucial remediation that addresses this specific access control weakness by removing the problematic permission modification process entirely.
This vulnerability highlights the importance of proper permission management during software installation processes and underscores why system administrators should carefully evaluate installation behaviors of third-party applications. The fix implemented in version 5.06 demonstrates effective vulnerability remediation through elimination of the insecure component rather than attempting to patch the permission issue after installation, which aligns with security principles that advocate for removing vulnerable code paths entirely when possible. The resolution effectively prevents the persistent exposure by ensuring that the setup process no longer modifies system-wide permissions inappropriately.