Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9

Export CSV
CVE-2025-6519

Consistent predictable generation of the password for the default admin user "ONEDAY" to the application services

E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Copeland
Products
E3 Supervisory Controller Firmware Site Supervisor Bx 860-1240 Site Supervisor Bxe 860-1245 and 5 more
CVE-2025-52544

Arbitrary read file from the filesystem

E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Copeland
Products
E3 Supervisory Controller Firmware Site Supervisor Bx 860-1240 Site Supervisor Bxe 860-1245 and 5 more
CVE-2025-52546

Stored XSS by uploading a specially crafted floor plan file

E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can inject a stored XSS to the floorplan web page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Copeland
Products
E3 Supervisory Controller Firmware Site Supervisor Bx 860-1240 Site Supervisor Bxe 860-1245 and 5 more
CVE-2025-52548

Enabling SSH and Shellinabox on the vulnerable machine

E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Copeland
Products
E3 Supervisory Controller Firmware Site Supervisor Bx 860-1240 Site Supervisor Bxe 860-1245 and 5 more
CVE-2025-52550

Firmware upgrade packages are unsigned

E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Copeland
Products
E3 Supervisory Controller Firmware Site Supervisor Bx 860-1240 Site Supervisor Bxe 860-1245 and 5 more