Under certain installation conditions the service account password used by BRAIN2 can be written in clear text to a setup log file. If the installation wizard is run with Integrated Security against Microsoft SQL Server and the account is specified, the password becomes stored in an unsecured log. This flaw allows an attacker who gains read access to the log through administrative privileges to obtain the credentials of the BRAIN2 service account, potentially enabling full control over the application’s backend.

Systems running BRAIN2 versions up to and including 3.09 from Bizerba SE & Co. KG are affected. The vulnerability is confined to installations where Integrated Security is employed and the service account is specified during setup.

The CVSS score of 4.4 indicates a moderate severity. Since the EPSS score is not available and the vulnerability is not listed in CISA KEV, the likelihood of exploitation is uncertain. However, exploitation requires administrative access to the target system, which is a prerequisite. Successful exploitation would lead to disclosure of the BRAIN2 service account credentials and thus could provide attackers with the ability to manipulate the system’s backend and data.