CVE-2026-16246

{
  "id": "CVE-2026-16246",
  "sourceIdentifier": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
  "published": "2026-07-20T12:17:56.087",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In BRAIN2 versions prior to 3.09, the\napplication LogPathConfig.exe is executed during setup. As a result, the\nWindows group Everyone is granted full control over %ProgramData% instead of\nbeing restricted to %ProgramData%\\Bizerba\\BRAIN2\\.\n\n\n\n\n\nStarting with BRAIN2 3.09, the setup no\nlonger executes this tool.\n\nHowever, the optional component Bizerba ScriptService still executes it.\n\n\n\n\n\nBizerba ScriptService is being\ndeprecated and will no longer be included starting with BRAIN2 version 3.11."
    },
    {
      "lang": "es",
      "value": "En las versiones de BRAIN2 anteriores a la 3.09, la aplicación LogPathConfig.exe se ejecuta durante la instalación. Como resultado, al grupo de Windows Todos se le concede control total sobre %ProgramData% en lugar de estar restringido a %ProgramData%\\Bizerba\\BRAIN2\\.\n\nA partir de BRAIN2 3.09, la instalación ya no ejecuta esta herramienta.\n\nSin embargo, el componente opcional Bizerba ScriptService aún lo ejecuta.\n\nBizerba ScriptService está siendo descontinuado y ya no se incluirá a partir de la versión 3.11 de BRAIN2."
    }
  ],
  "affected": [
    {
      "source": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
      "affectedData": [
        {
          "vendor": "Bizerba SE & Co. KG",
          "product": "BRAIN2",
          "defaultStatus": "affected",
          "platforms": [
            "Windows"
          ],
          "versions": [
            {
              "version": ">3.09",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-20T13:02:39.900691Z",
          "id": "CVE-2026-16246",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.bizerba.com/downloads/global/information-security/2026/bizerba-sa-2026-0003.pdf",
      "source": "0beee27a-7d8c-424f-8e46-ac453fa147e6"
    }
  ]
}