{"id":"CVE-2025-2862","aliases":["EUVD-2025-8627","GHSA-h7v6-4m6m-8gjj"],"status":"published","title":"Weak Encoding for Password vulnerability in saTECH BCU","description":"SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as the storage methods used are not strong enough in terms of encryption.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00215,"percentile":0.11956,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-261"],"published":"2025-03-28T13:15:08Z","modified":"2026-06-17T09:07:45Z","products":[{"vendor":"arteche","product":"satech bcu"},{"vendor":"arteche","product":"satech_bcu_firmware"}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu","tags":["Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2862"},{"url":"https://github.com/advisories/GHSA-h7v6-4m6m-8gjj"}],"sources":{"cve":[{"id":"CVE-2025-2862","title":"Weak Encoding for Password vulnerability in saTECH BCU","description":"SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as the storage methods used are not strong enough in terms of encryption.","status":"published","published":"2025-03-28T13:15:08.022Z","modified":"2025-03-28T13:34:42.132Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-261"],"updated_at":"2026-11-02T14:32:38.70481Z"}],"euvd":[{"id":"EUVD-2025-8627","description":"SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as the storage methods used are not strong enough in terms of encryption.","status":"published","published":"2025-03-28T13:15:08Z","modified":"2025-03-28T13:34:42Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:52:48.15902Z"}],"ghsa":[{"id":"GHSA-h7v6-4m6m-8gjj","title":"SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an...","description":"SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as the storage methods used are not strong enough in terms of encryption.","status":"published","published":"2025-03-28T15:31:56Z","modified":"2025-10-15T18:32:54Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-261"],"updated_at":"2026-11-02T15:04:00.063131Z"}],"nvd":[{"id":"CVE-2025-2862","description":"SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as the storage methods used are not strong enough in terms of encryption.","status":"published","published":"2025-03-28T14:15:21.257Z","modified":"2026-06-17T09:07:45.247Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-261"],"updated_at":"2026-11-02T14:10:56.494516Z"}]}}