CVE Feed

    Dashboard / CVE / CVE-2025-6519

    CVE-2025-6519

    E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.

    Published:Sep 2, 2025
    Last Modified:Oct 10, 2025
    EPS:Sep 2, 2025
    EPSS Score:0.00059
    CVSS Score:9.8

    Affected Products

    Vendor
    Copeland
    Product
    E3 Supervisory Controller Firmware
    Vendor
    Copeland
    Product
    Site Supervisor Bx 860-1240
    Vendor
    Copeland
    Product
    Site Supervisor Bxe 860-1245
    Vendor
    Copeland
    Product
    Site Supervisor Cx 860-1260
    Vendor
    Copeland
    Product
    Site Supervisor Cxe 860-1265
    Vendor
    Copeland
    Product
    Site Supervisor Rx 860-1220
    Vendor
    Copeland
    Product
    Site Supervisor Rxe 860-1225
    Vendor
    Copeland
    Product
    Site Supervisor Sf 860-1200

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-52550 (CVSS 8.6) — E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker ca…
    CVE-2025-52549 (CVSS 9.2) — E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An att…
    CVE-2025-52548 (CVSS 6.9) — E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services…
    CVE-2025-52547 (CVSS 8.7) — E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. …
    CVE-2025-52546 (CVSS 5.1) — E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenti…
    CVE-2025-52545 (CVSS 7.7) — E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, w…
    CVE-2025-52544 (CVSS 8.8) — E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenti…
    CVE-2025-52543 (CVSS 5.3) — E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side ha…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High