Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 46

Export CSV
CVE-2025-52546

Stored XSS by uploading a specially crafted floor plan file

E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can inject a stored XSS to the floorplan web page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Copeland
Products
E3 Supervisory Controller Firmware Site Supervisor Bx 860-1240 Site Supervisor Bxe 860-1245 and 5 more
CVE-2025-52548

Enabling SSH and Shellinabox on the vulnerable machine

E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Copeland
Products
E3 Supervisory Controller Firmware Site Supervisor Bx 860-1240 Site Supervisor Bxe 860-1245 and 5 more
CVE-2025-52550

Firmware upgrade packages are unsigned

E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Copeland
Products
E3 Supervisory Controller Firmware Site Supervisor Bx 860-1240 Site Supervisor Bxe 860-1245 and 5 more