Cross-Site Request Forgery in saTECH BCU Firmware

CVE-2025-2863

What is CVE-2025-2863?

A cross-site request forgery vulnerability exists in the web application of the saTECH BCU firmware version 2.1.3. This security issue allows an unauthenticated local attacker to exploit active administrator sessions, performing unauthorized actions based on the permissions of the logged-in user. Potential exploits may include rebooting the device or modifying user roles and permissions, thereby compromising the integrity and functionality of the device.

References