In _connect.BRAIN versions earlier than 5.06, the installer runs LogPathConfig.exe during setup. That utility removes the existing permission entries on the %ProgramData% directory and replaces them with a full-control grant to the Windows group Everyone. The flaw is a permission misconfiguration (CWE-276) that allows any user who can write to %ProgramData% to claim ownership of the directory and its contents. It does not provide direct code execution or remote impact, but it does allow an attacker to read or modify configuration files and other data stored there.

The affected product is Bizerba SE & Co. KG’s _connect.BRAIN. All releases prior to version 5.06 experience this issue. A fresh installation of version 5.06 or later prevents the LogPathConfig.exe tool from running during setup, thereby avoiding the permission overwrite.

The CVSS score of 7.3 classifies this flaw as high severity. The EPSS score is reported as less than 1 %, indicating a very low exploitation probability at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the installation of _connect.BRAIN, which normally runs with administrative privileges. An attacker who can influence or perform the installation can overwrite permissions, granting the Everyone group full control over %ProgramData%. If the directory’s permissions are not corrected, any user on the local system could read or modify configuration data in that location. No remote exploitation path is known. Upgrading to 5.06 or later and manually correcting permissions mitigates the risk.