CVE-2025-2861
Cleartext Transmission of Sensitive Information vulnerability in saTECH BCU
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.9EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
28 Mar 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that information is exchanged in unencrypted text. Since sensitive data such as credentials are exchanged, an attacker could obtain them and log in legitimately.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Arteche · saTECH BCUWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →