CVE-2025-2865: Arteche SaTECH BCU Firmware XSS Vulnerability

CVE-2025-2865 Overview

CVE-2025-2865 is a stored cross-site scripting (XSS) vulnerability affecting the Arteche SaTECH BCU firmware version 2.1.3. The web server component permits attackers to store malicious resources and script payloads. When an authenticated victim interacts with the crafted request, their browser interprets attacker-controlled content sourced from an external domain. The flaw is tracked under CWE-79 (Improper Neutralization of Input) and CWE-942 (Permissive Cross-domain Policy). The SaTECH BCU is a bay control unit used in electrical substation automation, making its web management interface a sensitive target within operational technology (OT) environments.

Critical Impact
Attackers with low-privilege access can persist malicious scripts on the BCU web interface and hijack sessions of operators who visit affected pages in industrial control environments.

Affected Products

Arteche SaTECH BCU firmware version 2.1.3
Arteche SaTECH BCU hardware device
Web management interface exposed by the firmware

Discovery Timeline

2025-03-28 - CVE-2025-2865 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2865

Vulnerability Analysis

The SaTECH BCU web server fails to neutralize user-supplied input before persisting it and returning it to other users. An authenticated attacker with limited privileges can submit crafted content through the web application. The content is stored server-side and later rendered in the browsers of legitimate operators.

Because the application also enforces a permissive cross-domain policy, attacker-controlled pages can load resources from external domains. This expands the impact from a traditional stored XSS to a broader content-injection issue where scripts, styles, or media served from attacker-owned infrastructure execute in the trusted origin.

Exploitation requires user interaction and local access to reach the management interface, which limits mass exploitation. However, in substation environments a single compromised operator session may expose control functions of a bay control unit.

Root Cause

The root cause is missing output encoding and input sanitization on fields rendered by the SaTECH BCU web server, combined with an overly permissive cross-origin policy that trusts external domains. See the INCIBE Security Notice: Multiple Vulnerabilities in Arteche SaTECH BCU for the vendor coordination details.

Attack Vector

An authenticated attacker stores a malicious payload in the web application. The payload references or loads additional resources from an attacker-controlled server. When a victim user views the affected page, their browser fetches and executes the remote resources in the origin of the BCU, enabling session theft, forced actions, or interface manipulation. The vulnerability requires local network access to the device and interaction from the target user.

Detection Methods for CVE-2025-2865

Indicators of Compromise

HTTP responses from the BCU web interface containing <script> tags or event handlers that reference external domains not owned by the operator
Unexpected outbound requests from operator workstations to unknown domains immediately after accessing the BCU management interface
New or modified entries in BCU configuration fields containing HTML or JavaScript syntax such as onerror=, javascript:, or <img src=

Detection Strategies

Inspect stored fields in the BCU web application for HTML control characters and script constructs during routine audits
Deploy network monitoring on the OT management VLAN to flag HTTP requests from BCU pages that pull resources from unapproved external hosts
Correlate operator login events with anomalous browser-initiated traffic to identify session-abuse patterns

Monitoring Recommendations

Enable and centralize web server access logs from the SaTECH BCU for retention and review
Monitor authentication events on the BCU for unexpected privilege use following operator interaction with the interface
Alert on egress traffic from engineering workstations to non-allowlisted domains during administrative sessions

How to Mitigate CVE-2025-2865

Immediate Actions Required

Restrict access to the SaTECH BCU web management interface to a dedicated management network segment and jump hosts
Enforce least privilege on BCU accounts and remove unused low-privilege users that could be leveraged to plant payloads
Instruct operators to access the BCU only from hardened workstations with strict browser policies and no general internet access

Patch Information

Refer to the INCIBE Security Notice for Arteche SaTECH BCU for coordinated vendor remediation guidance. Apply any firmware update released by Arteche that supersedes version 2.1.3 and addresses CWE-79 and CWE-942.

Workarounds

Place the BCU behind a reverse proxy or web application firewall that strips or encodes HTML metacharacters in stored fields
Enforce a strict Content Security Policy at the network layer to block resource loading from untrusted external origins
Disable or firewall outbound internet access from workstations used to administer the BCU

bash

# Example: block external egress from OT management workstations
# Replace interface and subnet values to match the environment
iptables -A OUTPUT -o eth0 -d 10.10.20.0/24 -j ACCEPT   # OT management subnet
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -j DROP   # block external HTTPS
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -j DROP    # block external HTTP