CVE-2025-2864 | THREATINT

Description

SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is set. This attack only impacts the victim's browser (reflected XSS).

Reserved 2025-03-27 | Published 2025-03-28 | Updated 2025-03-28 | Assigner INCIBE

LOW: 2.0CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status

unaffected

2.1.3

affected

Credits

Aarón Flecha finder

Gabriel Vía Echezarreta finder

References

www.incibe.es/...ultiple-vulnerabilities-arteches-satech-bcu

cve.org (CVE-2025-2864)

nvd.nist.gov (CVE-2025-2864)

Download JSON