CVE-2026-16247CWE-276

Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN

High · published July 20, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
3.2
In the wild
Unconfirmed
What it is

In _connect.BRAIN versions prior to 5.06,

the application LogPathConfig.exe is executed during setup. During this

process, existing permissions on %ProgramData% are deleted and replaced,

granting the Windows group Everyone full control instead of restricting

access to %ProgramData%\Bizerba\_connect.BRAIN or %ProgramData%\Bizerba\BCT.

Starting with _connect.BRAIN 5.06,

the setup no longer executes this tool.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00142 · 3.2th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2026-07-20T11:54Z
EPSS history
Timeline
  • 20 JUL 11:54Z
    Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN
    cvelistv5