CVE-2025-2864

SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is set. This attack only impacts the victim's browser (reflected XSS).

Score

CVSS 3.1 6.1 Medium

Status

Analyzed - cve-coordination@incibe.es

Published

2025-03-28

Last modified

2025-03-28

Weaknesses

CWE-79

Affected products

• Satech Bcu (Arteche)
• Satech Bcu Firmware (Arteche)

References

• https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu