CVEvulnerability

CVE-2025-52548

6.9 MEDIUM Published 2025-09-02 Modified 2026-10-05 Official page ↗
Status
Analyzed
Published
2025-09-02
Last modified
2026-10-05
Assigner
dd59f033-460c-4b88-a075-d4d3fedb6191
CVSS 4.0 (dd59f033-460c-4b88-a075-d4d3fedb6191)
6.9 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1242

Description

E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.

Affected configurations

• copeland e3 supervisory controller firmware (< 2.31f01)

Related

Weakness · CWE (1)

  • CWE-1242 Inclusion of Undocumented Features or Chicken Bits weakness

References