Vulnerability in Copeland E3 Supervisory Controller Firmware
CVE-2025-52548
E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.004 (28.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 28.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.000
Affected products
- Copeland E3 Supervisory Controller Firmware
- Copeland Site Supervisor Bx 860-1240
- Copeland Site Supervisor Bxe 860-1245
- Copeland Site Supervisor Cx 860-1260
- Copeland Site Supervisor Cxe 860-1265
- Copeland Site Supervisor Rx 860-1220
- Copeland Site Supervisor Rxe 860-1225
- Copeland Site Supervisor Sf 860-1200
- Copeland Lp E3 Supervisory Control — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- dd59f033-460c-4b88-a075-d4d3fedb6191 (Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2025-52548?
- CVE-2025-52548 is a medium-severity vulnerability in Copeland E3 Supervisory Controller Firmware, classified under CWE-1242. CVSS score: 4.9/10. Published 2025-09-02.
- How severe is CVE-2025-52548?
- Medium severity. CVSS v3 base score is 4.9 out of 10.
- Is CVE-2025-52548 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.