CVE-2025-2865CWE-942

Reflected Cross-Site Scripting (XSS) vulnerability in saTECH BCU

Low · published March 28, 2025

CVSS v4.0
2.4
EPSS
0%
Percentile
7.6
In the wild
Unconfirmed
What it is

SaTECH BCU, in its firmware version 2.1.3, could allow XSS attacks and other malicious resources to be stored on the web server. An attacker with some knowledge of the web application could send a malicious request to the victim users. Through this request, the victims would interpret the code (resources) stored on another malicious website owned by the attacker.

The record
Technical detail
CVSS v4.0
2.4 · LOW
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00184 · 7.6th percentile
Weakness
CWE-942 · Permissive Cross-domain Security Policy with Untrusted Domains
Published
2025-03-28T13:24Z
EPSS history
Timeline
  • 28 MAR 13:24Z
    Reflected Cross-Site Scripting (XSS) vulnerability in saTECH BCU
    cvelistv5