CVE Feed

    Dashboard / CVE / CVE-2025-52548

    CVE-2025-52548

    E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.

    Published:Sep 2, 2025
    Last Modified:Oct 1, 2025
    EPS:Sep 2, 2025
    EPSS Score:0.00047
    CVSS Score:4.9

    Affected Products

    Vendor
    Copeland
    Product
    E3 Supervisory Controller Firmware
    Vendor
    Copeland
    Product
    Site Supervisor Bx 860-1240
    Vendor
    Copeland
    Product
    Site Supervisor Bxe 860-1245
    Vendor
    Copeland
    Product
    Site Supervisor Cx 860-1260
    Vendor
    Copeland
    Product
    Site Supervisor Cxe 860-1265
    Vendor
    Copeland
    Product
    Site Supervisor Rx 860-1220
    Vendor
    Copeland
    Product
    Site Supervisor Rxe 860-1225
    Vendor
    Copeland
    Product
    Site Supervisor Sf 860-1200

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-212 Functionality Misuse
    CAPEC-36 Using Unpublished Interfaces or Functionality

    Related CVEs

    CVE-2025-52550 (CVSS 8.6) — E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker ca…
    CVE-2025-52549 (CVSS 9.2) — E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An att…
    CVE-2025-52547 (CVSS 8.7) — E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. …
    CVE-2025-52546 (CVSS 5.1) — E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenti…
    CVE-2025-52545 (CVSS 7.7) — E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, w…
    CVE-2025-52544 (CVSS 8.8) — E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenti…
    CVE-2025-52543 (CVSS 5.3) — E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side ha…
    CVE-2025-6519 (CVSS 9.3) — E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated passw…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High