CVE-2025-12507

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

The service Bizerba Communication Server (BCS) has an unquoted service path. Due to the way Windows searches the executable for the BCS service, malicious programs can be executed.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

Vendor	Product	Versions
Bizerba	_connect.BRAIN	>= 0.0, < 5.02

References

https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0005.pdf

Timeline

Published: Oct 31, 2025
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-125088.4When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of a CVE-2025-125098.4On a client with an admin user, a Global_Shipping script can be implemented. The script could later be executed on the BRAIN2 server with ad CVE-2025-125107.2The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.CVE-2025-125114.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM CVE-2025-125124.3The GenerateBlocks plugin for WordPress is vulnerable to information exposure due to missing object-level authorization checks in versions u CVE-2025-125134.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Host CVE-2025-125147.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring - Open-ticke CVE-2025-125159.8Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-125169.8Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-125175.3Credits Page not Matching Versions in Use in the FirmwareThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-125185.3beefree.io SDK is vulnerable to Stored XSS in Social Media icon URL parameter in email builder functionality. Malicious attacker can inject CVE-2025-125195.3Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modules) allows Accessing Functiona