CVE-2025-2858

High

Published: 28 March 2025

Published

28 March 2025

Modified

15 October 2025

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0003 8.4th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-2858 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Arteche Satech Bcu Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 8.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-6 Least Privilege good match

prevent

Enforces least privilege to prevent low-privileged CLI users from escalating to superuser via the exploitable 'nice' command.

AC-3 Access Enforcement good match

prevent

Requires enforcement of approved access authorizations, directly countering the bypass of restrictions in the firmware's CLI.

SI-2 Flaw Remediation good match

prevent

Addresses the specific firmware flaw by identifying, reporting, and applying timely remediation such as patches for the privilege escalation vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

The CVE describes a privilege escalation vulnerability (CWE-269) in the device's CLI that allows exploitation of the 'nice' command to bypass restrictions and gain superuser access from low-privileged network-accessible CLI, directly mapping to T1068: Exploitation for Privilege Escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Privilege escalation vulnerability in the saTECH BCU firmware version 2.1.3. An attacker with access to the CLI of the device could make use of the nice command to bypass all restrictions and elevate privileges as a superuser.

Deeper analysisAI

CVE-2025-2858 is a privilege escalation vulnerability (CWE-269) affecting the saTECH BCU firmware version 2.1.3. It allows an attacker with access to the device's command-line interface (CLI) to exploit the "nice" command, bypassing all restrictions to elevate privileges to superuser level. The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.

An attacker requires low privileges (PR:L) and network access to the device (AV:N) with low attack complexity and no user interaction needed. With CLI access, the exploit involves invoking the "nice" command to circumvent security controls, granting full superuser capabilities. This enables complete control over the device, potentially leading to unauthorized data access, modification of configurations, or disruption of operations.

For mitigation details, refer to the INCIBE-CERT advisory on multiple vulnerabilities in Arteche saTECH BCU: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu.