CVE-2025-6513CWE-260

BRAIN2 Configuration file for database access not sufficiently secured

Critical · published June 23, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
5.5
In the wild
Unconfirmed
What it is

🚨 Standard Windows users can snoop on your database config files! That's right—this CVE puts your sensitive info right in their hands. 🔥 Think of it like leaving your diary wide open on a park bench—anyone can just pick it up and read all your secrets without a second thought. With this flaw, users can decrypt sensitive information just as easily! An attacker could gain access to critical database credentials, allowing them to connect to your databases and potentially wreak havoc—reading, modifying, or even deleting your precious data. This could lead to an absolute disaster for businesses, resulting in severe data breaches and loss of trust.

Put simply

Think of it like leaving your diary wide open on a park bench—anyone can just pick it up and read all your secrets without a second thought. With this flaw, users can decrypt sensitive information just as easily! CVE-2025-6513 allows standard Windows users to access and decrypt the BRAIN2 application’s configuration file containing sensitive database access credentials, exposing it to unauthorized users.

What to do

An attacker could gain access to critical database credentials, allowing them to connect to your databases and potentially wreak havoc—reading, modifying, or even deleting your precious data. This could lead to an absolute disaster for businesses, resulting in severe data breaches and loss of trust. Immediately restrict access to the configuration file and review permissions for standard users. Update the BRAIN2 application to the latest version once the patch is available to eliminate this vulnerability. Regularly audit who has access to sensitive files to ensure compliance. You've got this! Keep your data locked down and patch this vulnerability to secure your database like a pro! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00166 · 5.5th percentile
Weakness
CWE-260 · Password in Configuration File
Published
2025-06-23T12:37Z
EPSS history
Timeline
  • 23 JUN 12:37Z
    BRAIN2 Configuration file for database access not sufficiently secured
    cvelistv5