Cyber Posture

CVE-2025-2859

Critical

Published: 28 March 2025

Published
28 March 2025
Modified
10 October 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0035 57.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries can use stolen session cookies to authenticate to web applications and services.

Security Summary

CVE-2025-2859 is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) classified under CWE-287 (Improper Authentication), published on 2025-03-28. It affects the Arteches Satech BCU device, where an attacker with network access can capture traffic to obtain user cookies. This enables session hijacking, allowing unauthorized access to the active user session.

An unauthenticated attacker (PR:N) on the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N) required can exploit this by intercepting unencrypted traffic. Successful exploitation grants the attacker the stolen session's privileges, enabling changes to the device via its web interface, with impacts including high confidentiality, integrity, and availability compromise (C:H/I:H/A:H).

The INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu provides details on this and related vulnerabilities in Arteches Satech BCU, including recommended mitigations such as applying patches or network segmentation where feasible.

Details

CWE(s)
CWE-287

Affected Products

arteche
satech bcu firmware
2.1.3

MITRE ATT&CK Enterprise Techniques

T1040 Network Sniffing Credential Access
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
Why these techniques?

Vulnerability enables capture of unencrypted session cookies from network traffic for session hijacking, mapping directly to network sniffing for credential capture, stealing web session cookies, and using stolen cookies as alternate authentication material.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References