CVE-2025-2862
Arteche Satech Bcu Firmware 2.1.3
Raw vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-2862 is a medium-severity Weak Encoding for Password (CWE-261) vulnerability in Arteche Satech Bcu Firmware. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-2862 is a vulnerability in the SaTECH BCU firmware version 2.1.3, where weak password encryption is implemented, classified under CWE-261. The issue stems from storage methods that lack sufficient encryption strength, enabling credential extraction. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to network accessibility, low attack complexity, and no requirements for privileges or user interaction.
An unauthenticated attacker with access to the device's system or website can exploit this vulnerability to obtain stored credentials. Exploitation requires no privileges and can occur remotely over the network with low complexity, resulting in high-impact confidentiality loss without affecting integrity or availability.
The INCIBE-CERT advisory (https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu), published on 2025-03-28, addresses multiple vulnerabilities in Arteches SaTECH BCU, including CVE-2025-2862.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8627
- 🇪🇸 INCIBE: www.incibe.es
Vulnerability Data
SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as the storage methods used are not strong enough in terms of encryption.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Cryptographic protection mandates approved algorithms and key management that preclude weak encoding schemes for sensitive data such as passwords.
Authenticator management requires secure generation, storage, and distribution of passwords rather than trivial encoding.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper cryptographic hashing for data-at-rest directly prevents trivial password encoding while the control addresses broader data protection needs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requires appropriate use of cryptography, indirectly discouraging weak encoding schemes.
Requires secure handling and protection of authentication information, directly addressing weak password encoding.
Enforces secure coding practices that would reject trivial password encoding.
Mandates secure authentication mechanisms, which precludes trivial encoding of passwords.