VulnerabilityAnalyzed

CVE-2025-52548

An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.

MEDIUM 6.9EPSS 0.34%

Does this matter?

Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.

Description

E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.34% probability · 27th percentile
CISA KEV: Not listed
Weakness: CWE-1242
Affected: copeland/e3 supervisory controller firmware
Source: dd59f033-460c-4b88-a075-d4d3fedb6191

References

https://www.armis.com/research/frostbyte10/Mitigation, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.