CVE-2025-2864
Reflected Cross-Site Scripting (XSS) vulnerability in saTECH BCU
- State
- Published
- Severity
- 2.0 Low
- Published
- Mar 28, 2025
- Updated
- Mar 28, 2025
- Reserved
- Mar 27, 2025
Description
SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is set. This attack only impacts the victim's browser (reflected XSS).
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.0 Low | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N | INCIBE |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
saTECH BCUArteche |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.