CVE-2025-52548 - CVE House
Back to Database
Status published Medium CVE-2025-52548

Enabling SSH and Shellinabox on the vulnerable machine

Vulnerability Description

E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-52548

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Armis Labs

References

More from Copeland LP

View All →
CVE-2025-6519
Consistent predictable generation of the password for the default admin user "ONEDAY" to the application services
Critical 9.3
CVE-2025-52551
Proprietary protocol allows for unauthenticated file operations
Critical 9.3
CVE-2025-52550
Firmware upgrade packages are unsigned
High 8.6
CVE-2025-52549
Predictable root linux password generation
Critical 9.2
CVE-2025-52547
DoS to the application services
High 8.7

Affected Vendor

Copeland LP

View all reports →

Affected Software

E3 Supervisory Control
Vulnerable Versions:
0

Timeline

Official Publish: September 2nd, 2025
Last Modified: September 2nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-1242

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.