Arteche manufactures a focused line of electrical substation automation and monitoring devices, centered on its SATECH BCU (Bay Control Unit) product and related firmware, which operate as critical infrastructure components in power distribution networks. Vulnerabilities affecting this vendor skew toward serious outcomes and recur through application-layer and communication security gaps—cross-site scripting, cleartext transmission of sensitive data, cross-site request forgery, information exposure, and authentication weaknesses—that reflect the demands of web-accessible industrial control interfaces. Defenders should prioritize patching for these devices given their role in power system visibility and control, and assess the exposure footprint of deployed units; current severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Arteche over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-2859CRITICAL An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depen | Mar 28, 2025 | 9.8 | 25 | NO | NO |
CVE-2025-2858HIGH Privilege escalation vulnerability in the saTECH BCU firmware version 2.1.3. An attacker with access to the CLI of the device could make use of the nice command to bypass all restr | Mar 28, 2025 | 8.8 | 24 | NO | NO |
CVE-2025-2863HIGH Cross-site request forgery (CSRF) vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenticated local attacker to exploit active a | Mar 28, 2025 | 7.8 | 21 | NO | NO |
CVE-2025-2862HIGH SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as th | Mar 28, 2025 | 7.5 | 20 | NO | NO |
CVE-2025-2861HIGH SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that information is exchanged in unencrypted text. Si | Mar 28, 2025 | 7.5 | 20 | NO | NO |
CVE-2025-2865MEDIUM SaTECH BCU, in its firmware version 2.1.3, could allow XSS attacks and other malicious resources to be stored on the web server. An attacker with some knowledge of the web applicat | Mar 28, 2025 | 6.1 | 18 | NO | NO |
CVE-2025-2864MEDIUM SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is set. This attack onl | Mar 28, 2025 | 6.1 | 18 | NO | NO |
CVE-2025-2860MEDIUM SaTECH BCU in its firmware version 2.1.3, allows an authenticated attacker to access information about the credentials that users have within the web (.xml file). In order to explo | Mar 28, 2025 | 5.3 | 16 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Arteche.
Media articles that mention a CVE ID that affects a product developed by Arteche — matched by CVE ID, not by vendor name.