← Back to CVE Explorer

CVE-2025-52543

Full vulnerability record from the local CVENow database.

Description

E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash.

Severity
MEDIUM
CVSS score
5.3 (v4.0)
Vulnerability status
Analyzed
Source identifier
dd59f033-460c-4b88-a075-d4d3fedb6191
Published
2025-09-02 12:15:36.453000
Last modified
2026-10-23 22:10:00.160000
View original CVE JSON 
{
  "id": "CVE-2025-52543",
  "sourceIdentifier": "dd59f033-460c-4b88-a075-d4d3fedb6191",
  "published": "2025-09-02T12:15:36.453",
  "lastModified": "2026-10-23T22:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash."
    },
    {
      "lang": "es",
      "value": "E3 Site Supervisor Control (versión de firmware anteriores a 2.31F01) servicios de aplicación (MGW y RCI) utiliza hashing del lado del cliente para la autenticación. Un atacante puede autenticarse al obtener solo el hash de la contraseña."
    }
  ],
  "affected": [
    {
      "source": "dd59f033-460c-4b88-a075-d4d3fedb6191",
      "affectedData": [
        {
          "vendor": "Copeland LP",
          "product": "E3 Supervisory Control",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "0",
              "lessThan": "2.31F01",
              "versionType": "firmware",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "dd59f033-460c-4b88-a075-d4d3fedb6191",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "LOW",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-02T13:36:46.415263Z",
          "id": "CVE-2025-52543",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "dd59f033-460c-4b88-a075-d4d3fedb6191",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-836"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:copeland:e3_supervisory_controller_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.31f01",
              "matchCriteriaId": "791AC7BF-A584-446A-A5FB-CB282430567A"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:copeland:site_supervisor_bx_860-1240:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "62991432-9156-4152-B940-4428A06ABBDA"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:copeland:site_supervisor_bxe_860-1245:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7281C06F-83DC-4A57-9076-B666C643B1A0"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:copeland:site_supervisor_cx_860-1260:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC339BFF-3123-4BE2-8092-3AD6FBB0AEFF"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:copeland:site_supervisor_cxe_860-1265:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C42AA549-5959-4E4D-81AD-9E04218EC157"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:copeland:site_supervisor_rx_860-1220:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F77BC1C-9709-40CB-AF4D-6A118D8F41E2"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:copeland:site_supervisor_rxe_860-1225:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F10BB44-439E-4823-8ECF-1700355C78E3"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:copeland:site_supervisor_sf_860-1200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B4909D80-1F06-437F-8D66-E39535B5E60D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.armis.com/research/frostbyte10/",
      "source": "dd59f033-460c-4b88-a075-d4d3fedb6191",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ]
    }
  ]
}