CVE-2025-2859

6.9 mediumEPSS 0.4%

Medium (6.9) in arteche satech bcu firmware. EPSS 0.4% chance of exploitation in the next 30 days.

An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user.

Severity

CVSS 4.0

6.9 medium

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2025-03-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

arteche:satech_bcu_firmware

References

https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu

Check your stack JSON