CVE-2025-2858
Published: 28 March 2025
Summary
CVE-2025-2858 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Arteche Satech Bcu Firmware. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 8.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-2858 is a privilege escalation vulnerability (CWE-269) affecting the saTECH BCU firmware version 2.1.3. It allows an attacker with access to the device's command-line interface (CLI) to exploit the "nice" command, bypassing all restrictions to elevate privileges to superuser level. The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
An attacker requires low privileges (PR:L) and network access to the device (AV:N) with low attack complexity and no user interaction needed. With CLI access, the exploit involves invoking the "nice" command to circumvent security controls, granting full superuser capabilities. This enables complete control over the device, potentially leading to unauthorized data access, modification of configurations, or disruption of operations.
For mitigation details, refer to the INCIBE-CERT advisory on multiple vulnerabilities in Arteche saTECH BCU: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8624
- 🇪🇸 INCIBE: www.incibe.es
Vulnerability details
Privilege escalation vulnerability in the saTECH BCU firmware version 2.1.3. An attacker with access to the CLI of the device could make use of the nice command to bypass all restrictions and elevate privileges as a superuser.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a privilege escalation vulnerability (CWE-269) in the device's CLI that allows exploitation of the 'nice' command to bypass restrictions and gain superuser access from low-privileged network-accessible CLI, directly mapping to T1068: Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces least privilege to prevent low-privileged CLI users from escalating to superuser via the exploitable 'nice' command.
Requires enforcement of approved access authorizations, directly countering the bypass of restrictions in the firmware's CLI.
Addresses the specific firmware flaw by identifying, reporting, and applying timely remediation such as patches for the privilege escalation vulnerability.