PT-2025-13519 · Unknown · Satech Bcu

Aarón Flecha · Published 2025-03-28 · Updated 2025-03-28 · CVE-2025-2861

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SaTECH BCU version 2.1.3

Description The issue concerns the use of the HTTP protocol for web browsing, which exchanges information in unencrypted text. This poses a problem as sensitive data, such as credentials, are exchanged and could be obtained by an attacker, allowing them to log in legitimately.

Recommendations For SaTECH BCU version 2.1.3, consider disabling the use of HTTP protocol for sensitive transactions until a secure alternative, such as HTTPS, is implemented. Restrict access to sensitive data and credentials to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2025-2861

Affected Products

Satech Bcu

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-2861 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2861 · Vendor Advisory
• https://incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu · Note
• https://twitter.com/CVEnew/status/1905674340898914738 · Twitter Post