CVE-2025-2864: Arteche Satech BCU Firmware XSS Vulnerability

CVE-2025-2864 Overview

CVE-2025-2864 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Arteche SaTECH BCU (Bay Control Unit) running firmware version 2.1.3. An attacker on an adjacent network can inject malicious script into the legitimate web interface of the affected device once a cookie is set. The injected payload executes in the victim's browser session and only affects that browser context. The SaTECH BCU is used in electrical substation automation, making the web management interface a sensitive target for social-engineering-driven attacks against operators.

Critical Impact
Successful exploitation allows an attacker to run attacker-controlled JavaScript in an operator's browser through the trusted device web interface, enabling session data theft or interface manipulation.

Affected Products

Arteche SaTECH BCU firmware version 2.1.3
Arteche SaTECH BCU hardware appliance
Deployments exposing the device web management interface on adjacent networks

Discovery Timeline

2025-03-28 - CVE-2025-2864 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2864

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the SaTECH BCU web interface. The device fails to properly neutralize user-controllable input before including it in the HTML response served to the client. When a browser holds a valid session cookie for the device, an attacker can craft a request that reflects malicious JavaScript back into the rendered page. The script then executes within the origin of the device's trusted web interface. Because the flaw is reflected rather than stored, exploitation depends on delivering a crafted URL or request to an authenticated operator.

Root Cause

The root cause is improper output encoding of request parameters that are echoed into HTML responses by the embedded web application. The firmware does not apply contextual escaping for HTML, attribute, or JavaScript contexts before rendering reflected data.

Attack Vector

Exploitation requires adjacent network access to the device and user interaction from a victim who already has a session cookie set for the BCU interface. The attacker delivers a crafted link or request that reflects the payload into the response, causing script execution in the victim's browser. Impact is confined to the victim's browser session and does not directly compromise the BCU firmware itself.

No verified public proof-of-concept code is available for this CVE. Refer to the INCIBE Vulnerability Notice for coordinated technical details.

Detection Methods for CVE-2025-2864

Indicators of Compromise

HTTP requests to the SaTECH BCU web interface containing script tags, JavaScript event handlers, or encoded payloads such as %3Cscript%3E in query parameters.
Unexpected outbound browser connections from operator workstations to attacker-controlled hosts shortly after accessing the BCU interface.
Web server access logs showing reflected parameters that contain HTML metacharacters like <, >, or ".

Detection Strategies

Inspect device HTTP logs and any upstream reverse proxy or WAF logs for request parameters carrying script content targeting the BCU management URLs.
Correlate operator browser telemetry with substation network traffic to identify anomalous script execution originating from the BCU web origin.
Deploy network intrusion detection signatures for common reflected XSS payloads on OT management VLANs where SaTECH BCU devices reside.

Monitoring Recommendations

Monitor authenticated sessions on the BCU interface for unusual referrers and externally crafted URLs delivered via email or chat to operators.
Alert on any modification of client-side content or cookie access patterns from the BCU origin observed in browser or endpoint telemetry.
Track EPSS trending for CVE-2025-2864 (currently 0.215%) alongside operator access patterns to reprioritize if exploitation activity increases.

How to Mitigate CVE-2025-2864

Immediate Actions Required

Restrict access to the SaTECH BCU web management interface to a dedicated management VLAN reachable only by authorized engineering workstations.
Instruct operators not to click external links while authenticated to the BCU interface and to close sessions when maintenance tasks complete.
Review Arteche support channels for firmware updates superseding version 2.1.3 and plan deployment during the next maintenance window.

Patch Information

At the time of publication, no vendor patch URL is listed in NVD for CVE-2025-2864. Coordinated disclosure was handled through INCIBE-CERT. Refer to the INCIBE Vulnerability Notice and contact Arteche for firmware guidance beyond version 2.1.3.

Workarounds

Place the BCU behind a reverse proxy or web application firewall configured to strip or encode HTML metacharacters in request parameters.
Enforce browser isolation or dedicated hardened workstations for accessing OT device web interfaces to limit XSS impact.
Disable or shorten session cookie lifetime on the BCU and require re-authentication for sensitive operations to reduce the exploitation window.

bash

# Example: restrict access to the BCU management interface with iptables
# Allow only the engineering workstation subnet to reach the BCU web UI
iptables -A FORWARD -s 10.10.20.0/24 -d 10.10.50.15 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.10.50.15 -p tcp --dport 443 -j DROP