CVE-2025-12508
BaseFortify
Publication date: 2025-10-31
Last updated on: 2025-11-04
Assigner: bizerba
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bizerba | brian2 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-319 | The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in BRAIN2 software versions prior to 3.0.7 when domain users are used as BRAIN2 users. The communication with Active Directory services is unencrypted, specifically authentication data is transmitted over unencrypted LDAP. This allows attackers to intercept authentication data, compromising confidentiality. [1]
How can this vulnerability impact me? :
The vulnerability can lead to interception of authentication data by attackers, which compromises the confidentiality, integrity, and availability of the system. This can result in unauthorized access, data breaches, and potential disruption of services. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring network traffic for unencrypted LDAP communication between BRAIN2 software and Active Directory services, especially if domain users are used as BRAIN2 users. You can use network analysis tools like Wireshark or tcpdump to capture and inspect LDAP traffic on port 389. For example, a command like 'tcpdump -i <interface> port 389' can help identify unencrypted LDAP traffic. Detecting authentication data sent in clear text over LDAP indicates the presence of this vulnerability. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of domain users as BRAIN2 users on unprotected networks and instead using local BRAIN2 users. The definitive solution is to update BRAIN2 software to version 3.0.7 or later, which supports encrypted communication via the LDAPS protocol with Active Directory services, thereby protecting authentication data from interception. [1]