CVE-2025-2864 Information

Description

SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device once the cookie is set. This attack only impacts the victim’s browser (reflected XSS).

Reference

https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu