CVE-2025-2859 is a critical (CVSS 9.8 in NVD) authentication flaw in the Arteche saTECH BCU. An attacker with network access can capture traffic, obtain user cookies and take over an active web session. INCIBE-CERT says Arteche fixed it in firmware version 2.2.1, so update to 2.2.1 or later.
What's affected
The record lists the Arteche saTECH BCU and its firmware as affected. INCIBE-CERT's notice, which covers several vulnerabilities in the product, says the issues were fixed by Arteche in firmware version 2.2.1 and names firmware 2.1.3 in its detail for related issues.
INCIBE scores this CVE with CVSS v4.0 at 6.9, with an adjacent network vector (AV:A) and a user interaction requirement. NVD's 9.8 uses a network vector and no interaction. The gap is worth noting when you decide urgency, but both reports agree on the fix and on the weakness.
Severity in the record: critical, CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Weakness classes: CWE-287 (Improper authentication).
How to check if you're exposed
This is an industrial device, so check its firmware version in the web interface, or in the device's own documentation, and compare it with 2.2.1.
Then look at how the device is reached. The weakness is that an observer on the network path can capture traffic and read the session cookie, so check whether the interface is served over plain HTTP, and whether any user logs in from a network you do not control.
Inventory is a good first step: find every saTECH BCU in the substations or plants you manage, including spares that are powered on in a lab.
What to do now
- Update the saTECH BCU firmware to 2.2.1 or later, following Arteche's instructions and your change process for operational equipment.
- Use encrypted access (HTTPS or a VPN) to the web interface, and do not log in over untrusted networks.
- Put the device on a segmented operational network, with no route from the internet.
- Limit which hosts can reach the interface, and log sign-ins.
- End sessions when you finish, and rotate credentials of users who may have signed in over an untrusted network.
- Review the other CVEs in the INCIBE notice, since the same firmware update covers them.
Why it matters
CWE-287 is improper authentication. In this record, the problem is that a valid user's session can be taken over by someone who sees the session cookie in transit. A session cookie works like a temporary password: whoever holds it is treated as the user. If the cookie travels without protection, then anyone on the path can copy it.
The lesson applies beyond this device: mark cookies as secure, serve interfaces over TLS, and keep management networks separate. Substation and plant equipment often cannot be patched quickly, so network controls carry much of the load until the change window arrives.
The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.
Quick check
Which firmware fixes CVE-2025-2859?
INCIBE-CERT says Arteche fixed the reported vulnerabilities in firmware version 2.2.1.
Why do NVD and INCIBE give different scores?
NVD records a 9.8 with a network vector and no interaction. INCIBE uses CVSS v4.0, an adjacent network vector and user interaction, and scores it 6.9. Use both to judge urgency for your own network layout.
Sources
Last reviewed: 19 October 2026.
