PT-2025-13518 · Unknown · Satech Bcu

Aarón Flecha · Published 2025-03-28 · Updated 2025-03-28 · CVE-2025-2860

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SaTECH BCU version 2.1.3

Description The issue allows an authenticated attacker to access information about user credentials within the web, specifically through an .xml file. To exploit this, the attacker must know the path, and this can be done regardless of the user's privileges on the website.

Recommendations For SaTECH BCU version 2.1.3, consider restricting access to the .xml file that contains user credentials until a patch is available. As a temporary workaround, limit the privileges of authenticated users to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-2860

Affected Products

Satech Bcu

References · 4

• https://osv.dev/vulnerability/CVE-2025-2860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2860 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu · Note
• https://twitter.com/CVEnew/status/1905674341922341350 · Twitter Post