Arteche saTECH BCU Session Hijacking Vulnerability via Cookie Theft

A vulnerability exists in Arteche's saTECH BCU control and automation equipment, specifically in version 2.1.3. This vulnerability allows an attacker with network access to intercept traffic and capture user cookies. By doing so, the attacker can hijack active user sessions and potentially make changes to the device through the web interface, depending on the privileges of the user whose session was stolen.

Impact

Exploitation of this vulnerability allows for session hijacking, where an attacker can impersonate a user and access their privileges on the device.

Remediation

Users can upgrade to saTECH BCU firmware version 2.2.1 to address this vulnerability.