CVE-2025-52546

Published: Sep 2, 2025Modified: Jun 17, 2026

5.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: dd59f033-460c-4b88-a075-d4d3fedb6191 (Secondary)

Description

E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can inject a stored XSS to the floorplan web page.

Affected (1)

Products: Copeland: E3 Supervisory Controller Firmware

Copeland

1 product

E3 Supervisory Controller Firmware

Configuration A

1 vulnerable · 7 platform

Vulnerable Software	Affected Versions
Copeland E3 Supervisory Controller Firmware	Before 2.31f01

Running on/with	Platform Versions
Copeland Site Supervisor Bx 860 1240	All versions
Copeland Site Supervisor Bxe 860 1245	All versions
Copeland Site Supervisor Cx 860 1260	All versions
Copeland Site Supervisor Cxe 860 1265	All versions
Copeland Site Supervisor Rx 860 1220	All versions
Copeland Site Supervisor Rxe 860 1225	All versions
Copeland Site Supervisor Sf 860 1200	All versions

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (1)

https://www.armis.com/research/frostbyte10/

Source: dd59f033-460c-4b88-a075-d4d3fedb6191

MitigationThird Party Advisory

Timeline

No history available yet.