Vulnerability in Copeland E3 Supervisory Controller Firmware
CVE-2025-52548
E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.
EPSS: 0.003 (27.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Copeland E3_supervisory_controller_firmware
- Copeland Site_supervisor_bx_860-1240
- Copeland Site_supervisor_bxe_860-1245
- Copeland Site_supervisor_cx_860-1260
- Copeland Site_supervisor_cxe_860-1265
- Copeland Site_supervisor_rx_860-1220
- Copeland Site_supervisor_rxe_860-1225
- Copeland Site_supervisor_sf_860-1200
- Copeland Lp E3 Supervisory Control — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- dd59f033-460c-4b88-a075-d4d3fedb6191 (Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2025-52548?
- CVE-2025-52548 is a medium-severity vulnerability in Copeland E3 Supervisory Controller Firmware, classified under CWE-1242. CVSS score: 4.9/10. Published 2025-09-02.
- How severe is CVE-2025-52548?
- Medium severity. CVSS v3 base score is 4.9 out of 10.
- Is CVE-2025-52548 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.