CVE-2025-2865
Reflected Cross-Site Scripting (XSS) vulnerability in saTECH BCU
- State
- Published
- Severity
- 2.4 Low
- Published
- Mar 28, 2025
- Updated
- Mar 28, 2025
- Reserved
- Mar 27, 2025
Description
SaTECH BCU, in its firmware version 2.1.3, could allow XSS attacks and other malicious resources to be stored on the web server. An attacker with some knowledge of the web application could send a malicious request to the victim users. Through this request, the victims would interpret the code (resources) stored on another malicious website owned by the attacker.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.4 Low | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | INCIBE |
Weaknesses
- CWE-942 Permissive Cross-domain Policy with Untrusted Domains
Affected Products
| Product | Versions |
|---|---|
saTECH BCUArteche |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.