MEDIUM🇵🇱 Wersja polska

CVE-2025-52548

CVSS 6.9v4.0pub. 2025-09-02upd. 2025-10-01

E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Copeland E3 Supervisory Controller Firmware
OS
Copeland
< 2.31f01
Copeland Site Supervisor Bx 860 1240
HW
Copeland
wszystkie wersje
Copeland Site Supervisor Bxe 860 1245
HW
Copeland
wszystkie wersje
Copeland Site Supervisor Cx 860 1260
HW
Copeland
wszystkie wersje
Copeland Site Supervisor Cxe 860 1265
HW
Copeland
wszystkie wersje
Copeland Site Supervisor Rx 860 1220
HW
Copeland
wszystkie wersje
Copeland Site Supervisor Rxe 860 1225
HW
Copeland
wszystkie wersje
Copeland Site Supervisor Sf 860 1200
HW
Copeland
wszystkie wersje

🔵

CHECK WITH VENDOR

No clear patch data available. Check vendor references.

CWE

References

www.armis.com/research/frostbyte10/…

Related vulnerabilities

CVE-2025-6519CRITICAL9.3PL ✓ten sam produkt

Przewidywalne hasło domyślnego konta administratora w Copeland Site Supervisor

CVE-2025-52549CRITICAL9.2PL ✓ten sam produkt

Przewidywalne hasło root w urządzeniach Copeland Site Supervisor (E3)

CVE-2025-52545HIGH7.7ten sam produkt

E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, w...

CVE-2025-52547HIGH8.7ten sam produkt

E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. ...

CVE-2025-52544HIGH8.8ten sam produkt

E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenti...