CVE-2025-2861
Published: 28 March 2025
Description
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Security Summary
CVE-2025-2861 is a vulnerability in the SaTECH BCU firmware version 2.1.3, where the web interface uses the HTTP protocol instead of a secure alternative. This results in the exchange of sensitive information, such as credentials, in unencrypted plaintext during web browsing sessions. Classified under CWE-319 (Cleartext Transmission of Sensitive Information), the issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting high confidentiality impact with network accessibility and low attack complexity.
Any attacker with access to the network traffic between a user and the affected device can exploit this vulnerability without requiring privileges or user interaction. By performing a man-in-the-middle interception, the attacker can capture transmitted credentials and subsequently log in legitimately to the SaTECH BCU, potentially gaining unauthorized access to its functions.
The INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu details this and other vulnerabilities in Artech's SaTECH BCU, providing guidance on mitigations for affected deployments.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Vulnerability enables MITM interception of cleartext credentials over HTTP (T1557), which are then used for unauthorized login via valid accounts (T1078).