Arteche saTECH BCU Firmware 2.1.3

SaTECH BCU, in its firmware version 2.1.3, could allow XSS attacks and other malicious resources to be stored on the web server. An attacker with some knowledge of the web application could send a malicious request to the victim users. Through this request, the victims would interpret the code (resources) stored on another malicious website owned by the attacker.

Published: 2025-03-28T13:24:47.015Z
Updated: 2025-03-28T14:32:18.569Z

SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is set. This attack only impacts the victim's browser (reflected XSS).

Published: 2025-03-28T13:23:41.194Z
Updated: 2025-03-28T14:32:45.839Z

Cross-site request forgery (CSRF) vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenticated local attacker to exploit active administrator sessions and perform malicious actions. The malicious actions that can be executed by the attacker depend on the logged-in user, and may include rebooting the device or modifying roles and permissions.

Published: 2025-03-28T13:22:38.259Z
Updated: 2025-03-28T14:33:15.200Z

SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as the storage methods used are not strong enough in terms of encryption.

Published: 2025-03-28T13:15:08.022Z
Updated: 2025-03-28T13:34:42.132Z

SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that information is exchanged in unencrypted text. Since sensitive data such as credentials are exchanged, an attacker could obtain them and log in legitimately.

Published: 2025-03-28T13:11:29.282Z
Updated: 2025-04-03T12:58:35.556Z