CVE-2025-2860CWE-200

Exposure of Sensitive Information vulnerability in saTECH BCU

Medium · published March 28, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

SaTECH BCU in its firmware version 2.1.3, allows an authenticated attacker to access information about the credentials that users have within the web (.xml file). In order to exploit this vulnerability, the attacker must know the path, regardless of the user's privileges on the website.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00299 · 21.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-03-28T13:10Z
EPSS history
Timeline
  • 28 MAR 13:10Z
    Exposure of Sensitive Information vulnerability in saTECH BCU
    cvelistv5