PT-2025-13526 · Satech · Satech Bcu

Aarón Flecha · Published 2025-03-28 · Updated 2025-03-28 · CVE-2025-2863

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions saTECH BCU firmware version 2.1.3

Description The issue is related to a cross-site request forgery (CSRF) vulnerability in the web application, which could allow an unauthenticated local attacker to exploit active administrator sessions and perform malicious actions. The malicious actions that can be executed by the attacker depend on the logged-in user, and may include rebooting the device or modifying roles and permissions.

Recommendations For saTECH BCU firmware version 2.1.3, consider implementing additional security measures to prevent CSRF attacks, such as validating requests to ensure they come from an authentic source, until a patch is available. As a temporary workaround, restrict access to the web application to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-2863

Affected Products

Satech Bcu

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-2863 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2863 · Vendor Advisory
• https://incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu · Note
• https://twitter.com/CVEnew/status/1905674337866449124 · Twitter Post