High severity · published Mar 28, 2025
CVE-2025-2863
Cross-site request forgery (CSRF) vulnerability in saTECH BCU
7.8
CVSS
0.1%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenticated local attacker to exploit active administrator sessions and perform malicious actions. The malicious actions that can be executed by the attacker depend on the logged-in user, and may include rebooting the device or modifying roles and permissions.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
saTECH BCU · Arteche
2.1.3 · source: vendor
SB
Satech Bcu Firmware · Arteche
2.1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2863
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2863
Third Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
More from saTECH BCU
9.8
CVE-2025-2859
Improper Authentication vulnerability in saTECH BCU
8.8
CVE-2025-2858
Privilege escalation vulnerability in saTECH BCU
7.5
CVE-2025-2862
Weak Encoding for Password vulnerability in saTECH BCU
7.5
CVE-2025-2861
Cleartext Transmission of Sensitive Information vulnerability in saTECH BCU
6.1
CVE-2025-2865
Reflected Cross-Site Scripting (XSS) vulnerability in saTECH BCU