CVE-2025-2859
Published: 28 March 2025
Summary
CVE-2025-2859 is a medium-severity Improper Authentication (CWE-287) vulnerability in Arteche Satech Bcu Firmware. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked in the top 43.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SC-8 (Transmission Confidentiality and Integrity).
Deeper analysis
CVE-2025-2859 is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) classified under CWE-287 (Improper Authentication), published on 2025-03-28. It affects the Arteches Satech BCU device, where an attacker with network access can capture traffic to obtain user cookies. This enables session hijacking, allowing unauthorized access to the active user session.
An unauthenticated attacker (PR:N) on the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N) required can exploit this by intercepting unencrypted traffic. Successful exploitation grants the attacker the stolen session's privileges, enabling changes to the device via its web interface, with impacts including high confidentiality, integrity, and availability compromise (C:H/I:H/A:H).
The INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu provides details on this and related vulnerabilities in Arteches Satech BCU, including recommended mitigations such as applying patches or network segmentation where feasible.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8625
- 🇪🇸 INCIBE: www.incibe.es
Vulnerability details
An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables capture of unencrypted session cookies from network traffic for session hijacking, mapping directly to network sniffing for credential capture, stealing web session cookies, and using stolen cookies as alternate authentication material.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Protects the confidentiality and integrity of transmitted information, directly preventing attackers from capturing unencrypted user cookies over the network.
Requires identification, reporting, and timely remediation of security flaws like CVE-2025-2859 in the Arteches Satech BCU device.
Ensures authenticity of communications sessions, mitigating unauthorized use of stolen session cookies for device changes.