Copeland Site_supervisor_cxe_860-1265

9 CVEs affecting Copeland Site_supervisor_cxe_860-1265. Latest disclosed: 2025-09-02. Critical: 2, High: 5.

Top CVEs affecting Copeland Site_supervisor_cxe_860-1265
CVESeverityScorePublishedSummary
CVE-2025-6519Critical9.82025-09-02E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the pas…
CVE-2025-52549Critical9.82025-09-02E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An attacker can generate the root linux password for a…
CVE-2025-52547High7.52025-09-02E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously…
CVE-2025-52545High7.52025-09-02E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes fo…
CVE-2025-52544High7.52025-09-02E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By upl…
CVE-2025-52543High7.52025-09-02E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authent…
CVE-2025-52550High7.22025-09-02E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An a…
CVE-2025-52546Medium6.12025-09-02E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By upl…
CVE-2025-52548Medium4.92025-09-02E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist bu…