CVE-2025-2864 — Reflected Cross-Site Scripting (XSS) vulnerability in saTECH BCU

CVE-2025-2864

Reflected Cross-Site Scripting (XSS) vulnerability in saTECH BCU PUBLISHED

Description (CNA)

SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is set. This attack only impacts the victim's browser (reflected XSS).

Affected (CNA)

Vendor / product	Versions
Arteche / saTECH BCU	affected 2.1.3

CWE

CWE-79

References

https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.