Medium severity · published Mar 28, 2025
CVE-2025-2860
Exposure of Sensitive Information vulnerability in saTECH BCU
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
SaTECH BCU in its firmware version 2.1.3, allows an authenticated attacker to access information about the credentials that users have within the web (.xml file). In order to exploit this vulnerability, the attacker must know the path, regardless of the user's privileges on the website.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
saTECH BCU · Arteche
2.1.3 · source: vendor
SB
Satech Bcu Firmware · Arteche
2.1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2860
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2860
Third Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
More from saTECH BCU
9.8
CVE-2025-2859
Improper Authentication vulnerability in saTECH BCU
8.8
CVE-2025-2858
Privilege escalation vulnerability in saTECH BCU
7.8
CVE-2025-2863
Cross-site request forgery (CSRF) vulnerability in saTECH BCU
7.5
CVE-2025-2862
Weak Encoding for Password vulnerability in saTECH BCU
7.5
CVE-2025-2861
Cleartext Transmission of Sensitive Information vulnerability in saTECH BCU