CVE-2025-2864CWE-79

Reflected Cross-Site Scripting (XSS) vulnerability in saTECH BCU

Low · published March 28, 2025

CVSS v4.0
2.0
EPSS
0%
Percentile
13.3
In the wild
Unconfirmed
What it is

SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is set. This attack only impacts the victim's browser (reflected XSS).

The record
Technical detail
CVSS v4.0
2.0 · LOW
Vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00233 · 13.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-03-28T13:23Z
EPSS history
Timeline
  • 28 MAR 13:23Z
    Reflected Cross-Site Scripting (XSS) vulnerability in saTECH BCU
    cvelistv5