Cleartext Password Exposure in BRAIN2 by Bizerba on Windows

CVE-2026-112250

What is CVE-2026-112250?

A security vulnerability exists in BRAIN2 versions up to and including 3.09, where the password of a Windows service account can be inadvertently logged in cleartext. This issue arises during installation when Microsoft SQL Server access is set using Integrated Security and the Windows account for the BRAIN2 MainService is selected. The resulting setup log file, saved in the temporary directory of the Windows administrator, may expose sensitive credentials, though access is generally restricted to users with administrative privileges. Successful exploitation of this flaw could lead to unauthorized access to the BRAIN2 service account.

References