CVE-2025-6512 - Vulnerability Details - OpenCVE

On a client with a non-admin user, a script can be integrated into a report. The reports could later be executed on the BRAIN2 server with administrator rights.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0004.pdf

History

Mon, 23 Jun 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 23 Jun 2025 13:15:00 +0000

Type	Values Removed	Values Added
Description		On a client with a non-admin user, a script can be integrated into a report. The reports could later be executed on the BRAIN2 server with administrator rights.
Title		Scripts within reports executable on BRAIN2 Server
Weaknesses		CWE-94
References		https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0004.pdf
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: bizerba

Published: 2025-06-23T12:48:33.951Z

Updated: 2025-06-23T13:22:47.485Z

Reserved: 2025-06-23T09:36:41.905Z

Link: CVE-2025-6512

Vulnrichment

Updated: 2025-06-23T13:22:43.966Z

NVD

Status : Awaiting Analysis

Published: 2025-06-23T13:15:22.460

Modified: 2025-06-23T20:16:21.633

Link: CVE-2025-6512

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-6512", "assignerOrgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6", "state": "PUBLISHED", "assignerShortName": "bizerba", "dateReserved": "2025-06-23T09:36:41.905Z", "datePublished": "2025-06-23T12:48:33.951Z", "dateUpdated": "2025-06-23T13:22:47.485Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "platforms": ["Windows", "x86"], "product": "BRAIN2", "vendor": "Bizerba SE & Co. KG", "versions": [{"lessThan": "3.06", "status": "affected", "version": "0.0", "versionType": "semver"}]}], "datePublic": "2025-06-22T22:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "On a client with a non-admin user, a script can be integrated into a report. The reports could later be executed on the BRAIN2 server with administrator rights."}], "value": "On a client with a non-admin user, a script can be integrated into a report. The reports could later be executed on the BRAIN2 server with administrator rights."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6", "shortName": "bizerba", "dateUpdated": "2025-06-23T12:48:33.951Z"}, "references": [{"url": "https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0004.pdf"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to the newest Version 3.06<br>"}], "value": "Update to the newest Version 3.06"}], "source": {"advisory": "BIZERBA-SA-2025-0004", "discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2025-06-22T22:00:00.000Z", "value": "Release of new Version BRAIN2 3.06"}], "title": "Scripts within reports executable on BRAIN2 Server", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "BRAIN2 users can be deprived of the right to edit the reports<br>"}], "value": "BRAIN2 users can be deprived of the right to edit the reports"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-23T13:22:41.924297Z", "id": "CVE-2025-6512", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-23T13:22:47.485Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6512", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-23T13:22:41.924297Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-23T13:22:43.966Z"}}], "cna": {"title": "Scripts within reports executable on BRAIN2 Server", "source": {"advisory": "BIZERBA-SA-2025-0004", "discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Bizerba SE & Co. KG", "product": "BRAIN2", "versions": [{"status": "affected", "version": "0.0", "lessThan": "3.06", "versionType": "semver"}], "platforms": ["Windows", "x86"], "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2025-06-22T22:00:00.000Z", "value": "Release of new Version BRAIN2 3.06"}], "solutions": [{"lang": "en", "value": "Update to the newest Version 3.06", "supportingMedia": [{"type": "text/html", "value": "Update to the newest Version 3.06<br>", "base64": false}]}], "datePublic": "2025-06-22T22:00:00.000Z", "references": [{"url": "https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0004.pdf"}], "workarounds": [{"lang": "en", "value": "BRAIN2 users can be deprived of the right to edit the reports", "supportingMedia": [{"type": "text/html", "value": "BRAIN2 users can be deprived of the right to edit the reports<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "On a client with a non-admin user, a script can be integrated into a report. The reports could later be executed on the BRAIN2 server with administrator rights.", "supportingMedia": [{"type": "text/html", "value": "On a client with a non-admin user, a script can be integrated into a report. The reports could later be executed on the BRAIN2 server with administrator rights.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6", "shortName": "bizerba", "dateUpdated": "2025-06-23T12:48:33.951Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6512", "state": "PUBLISHED", "dateUpdated": "2025-06-23T13:22:47.485Z", "dateReserved": "2025-06-23T09:36:41.905Z", "assignerOrgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6", "datePublished": "2025-06-23T12:48:33.951Z", "assignerShortName": "bizerba"}, "dataVersion": "5.1"}