Back to Database
Status published
Medium
CVE-2025-52543
Login to the application services using only the password hash
Vulnerability Description
E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-52543
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Armis Labs
References
More from Copeland LP
View All →CVE-2025-6519
Consistent predictable generation of the password for the default admin user "ONEDAY" to the application services
Critical
9.3
CVE-2025-52551
Proprietary protocol allows for unauthenticated file operations
Critical
9.3
CVE-2025-52550
Firmware upgrade packages are unsigned
High
8.6
CVE-2025-52549
Predictable root linux password generation
Critical
9.2
CVE-2025-52548
Enabling SSH and Shellinabox on the vulnerable machine
Medium
6.9
Affected Vendor
Copeland LP
View all reports →Affected Software
E3 Supervisory Control
Vulnerable Versions:
0
Timeline
Official Publish:
September 2nd, 2025
Last Modified:
September 2nd, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.