{"id":"CVE-2025-52548","state":"PUBLISHED","title":"Enabling SSH and Shellinabox on the vulnerable machine","description":"E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.","publishedAt":"2025-09-02T11:26:08.636Z","updatedAt":"2025-09-02T13:28:08.207Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","source":"Armis"},"assigner":"Armis","products":["Copeland LP E3 Supervisory Control"],"affected":[{"vendor":"Copeland LP","product":"E3 Supervisory Control","defaultStatus":"affected","versions":[{"version":"0","status":"affected","lessThan":"2.31F01","versionType":"firmware"}]}],"references":["https://www.armis.com/research/frostbyte10/"],"weaknesses":["CWE-1242"],"ingestedAt":"2026-10-29T20:09:31.862Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/52xxx/CVE-2025-52548.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-52548","state":"PUBLISHED","datePublished":"2025-09-02T11:26:08.636Z","dateUpdated":"2025-09-02T13:28:08.207Z","assignerShortName":"Armis","assignerOrgId":"dd59f033-460c-4b88-a075-d4d3fedb6191","dateReserved":"2025-06-17T17:29:21.841Z"},"containers":{"cna":{"title":"Enabling SSH and Shellinabox on the vulnerable machine","descriptions":[{"lang":"en","value":"E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS."}],"affected":[{"vendor":"Copeland LP","product":"E3 Supervisory Control","defaultStatus":"affected","versions":[{"version":"0","status":"affected","lessThan":"2.31F01","versionType":"firmware"}]}],"references":[{"url":"https://www.armis.com/research/frostbyte10/"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1242","description":"CWE-1242","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Armis","orgId":"dd59f033-460c-4b88-a075-d4d3fedb6191","dateUpdated":"2025-09-02T11:26:08.636Z"},"credits":[{"lang":"en","type":"finder","value":"Armis Labs"}],"datePublic":"2025-07-29T12:00:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade firmware of affected E3 Supervisory Controls to a version &gt; 2.30F1.<br>"}],"value":"Upgrade firmware of affected E3 Supervisory Controls to a version > 2.30F1."}],"source":{"discovery":"UNKNOWN"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Restrict access to the E3 Supervisory Controls network interface (ETH 0) by use of restricted VLAN or subnet and / or network firewall. Ensure the restricted VLAN or subnet is never accessible from untrusted networks."}],"value":"Restrict access to the E3 Supervisory Controls network interface (ETH 0) by use of restricted VLAN or subnet and / or network firewall. Ensure the restricted VLAN or subnet is never accessible from untrusted networks."}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-02T13:27:58.507057Z","id":"CVE-2025-52548","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-02T13:28:08.207Z"}}]}}}