CVE-2025-12508 describes a vulnerability where communication between BRAIN2 users configured as domain users and Active Directory services is unencrypted. This lack of encryption can allow interception of authentication data, compromising confidentiality and potentially integrity and availability.