E3 Supervisory Controller Firmware

e3_supervisory_controller_firmware

Vendor: Copeland • 9 CVEs

CVEs (9)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-6519 1Copeland 1E3 Supervisory Controller Firmware Jun 17, 2026 Sep 2, 2025 9.3 CRITICAL· v4 9.8 CRITICAL· v3 N/A· v2 E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modifi...Show more E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.Show less
CVE-2025-52550 1Copeland 1E3 Supervisory Controller Firmware Jun 17, 2026 Sep 2, 2025 8.6 HIGH· v4 7.2 HIGH· v3 N/A· v2 E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can ins...Show more E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade.Show less
CVE-2025-52549 1Copeland 1E3 Supervisory Controller Firmware Jun 17, 2026 Sep 2, 2025 9.2 CRITICAL· v4 9.8 CRITICAL· v3 N/A· v2 E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An attacker can generate the root linux password for a vulnerable device based on known or easy to fetch parameters.
CVE-2025-52548 1Copeland 1E3 Supervisory Controller Firmware Jun 17, 2026 Sep 2, 2025 6.9 MEDIUM· v4 4.9 MEDIUM· v3 N/A· v2 E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to t...Show more E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.Show less
CVE-2025-52547 1Copeland 1E3 Supervisory Controller Firmware Jun 17, 2026 Sep 2, 2025 8.7 HIGH· v4 7.5 HIGH· v3 N/A· v2 E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services.
CVE-2025-52546 1Copeland 1E3 Supervisory Controller Firmware Jun 17, 2026 Sep 2, 2025 5.1 MEDIUM· v4 6.1 MEDIUM· v3 N/A· v2 E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can i...Show more E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can inject a stored XSS to the floorplan web page.Show less
CVE-2025-52545 1Copeland 1E3 Supervisory Controller Firmware Jun 17, 2026 Sep 2, 2025 7.7 HIGH· v4 7.5 HIGH· v3 N/A· v2 E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services.
CVE-2025-52544 1Copeland 1E3 Supervisory Controller Firmware Jun 17, 2026 Sep 2, 2025 8.8 HIGH· v4 7.5 HIGH· v3 N/A· v2 E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can a...Show more E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system.Show less
CVE-2025-52543 1Copeland 1E3 Supervisory Controller Firmware Jun 17, 2026 Sep 2, 2025 5.3 MEDIUM· v4 7.5 HIGH· v3 N/A· v2 E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash.