Back to Database
Status published
High
CVE-2025-52545
Privilege escalation in the application services
Vulnerability Description
E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-52545
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Armis Labs
References
More from Copeland LP
View All →CVE-2025-6519
Consistent predictable generation of the password for the default admin user "ONEDAY" to the application services
Critical
9.3
CVE-2025-52551
Proprietary protocol allows for unauthenticated file operations
Critical
9.3
CVE-2025-52550
Firmware upgrade packages are unsigned
High
8.6
CVE-2025-52549
Predictable root linux password generation
Critical
9.2
CVE-2025-52548
Enabling SSH and Shellinabox on the vulnerable machine
Medium
6.9
Affected Vendor
Copeland LP
View all reports →Affected Software
E3 Supervisory Control
Vulnerable Versions:
0
Timeline
Official Publish:
September 2nd, 2025
Last Modified:
September 2nd, 2025
Added to House:
July 22nd, 2026