CVE-2026-112250
Received Received - Intake

Cleartext Password Exposure in BRAIN2 Software

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: bizerba

Description
A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the password of a Windows service account may be written in cleartext to a setup log file. The issue occurs when Microsoft SQL Server access is configured using Integrated Security and the Windows account intended to run the BRAIN2 MainService is specified during execution of the BRAIN2 installation wizard. The setup log file is stored in the temporary directory of the Windows administrator performing the installation. This directory is not accessible to standard Windows users and can generally only be accessed by users with administrative privileges. Successful exploitation could result in the disclosure of credentials belonging to the configured BRAIN2 service account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-112250
EUVD
EUVD-2026-109706

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Bizerba SE & Co. KG BRAIN2 0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects BRAIN2 versions up to 3.09. During installation, if Microsoft SQL Server access is configured using Integrated Security and a Windows service account is specified, the account password may be written in cleartext to a setup log file. The log file is stored in the administrator's temporary directory and is only accessible to users with administrative privileges.

Detection Guidance

Check the Windows temporary directory for installation log files created during BRAIN2 setup. Look for files matching the naming convention mentioned in the advisory and inspect them for cleartext passwords.

Impact Analysis

If exploited, this vulnerability could lead to the disclosure of credentials for the configured BRAIN2 service account. This account has local administrative privileges and the ability to 'Log on as a service', which could allow attackers to gain elevated access to the system.

Mitigation Strategies
  • Upgrade BRAIN2 to version 3.10 or later to address the vulnerability.
  • Delete any existing installation log files that may contain cleartext passwords.
  • Restrict administrative access to systems where BRAIN2 is installed.
  • Protect temporary directories to prevent unauthorized access.
  • Change the service account password if exposure is suspected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112250. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart