← Back to CVE Explorer

CVE-2025-52545

Full vulnerability record from the local CVENow database.

Description

E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services.

Severity
HIGH
CVSS score
7.7 (v4.0)
Vulnerability status
Analyzed
Source identifier
dd59f033-460c-4b88-a075-d4d3fedb6191
Published
2025-09-02 12:15:36.860000
Last modified
2026-10-23 22:10:00.160000
View original CVE JSON 
{
  "id": "CVE-2025-52545",
  "sourceIdentifier": "dd59f033-460c-4b88-a075-d4d3fedb6191",
  "published": "2025-09-02T12:15:36.860",
  "lastModified": "2026-10-23T22:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services."
    },
    {
      "lang": "es",
      "value": "E3 Site Supervisor Control (versión de firmware anteriores a 2.31F01) el servicio RCI contiene una llamada a la API para leer información de usuarios, que devuelve todos los nombres de usuario y hashes de contraseña para los servicios de la aplicación."
    }
  ],
  "affected": [
    {
      "source": "dd59f033-460c-4b88-a075-d4d3fedb6191",
      "affectedData": [
        {
          "vendor": "Copeland LP",
          "product": "E3 Supervisory Control",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "0",
              "lessThan": "2.31F01",
              "versionType": "firmware",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "dd59f033-460c-4b88-a075-d4d3fedb6191",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "LOW",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-02T13:32:10.508184Z",
          "id": "CVE-2025-52545",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "dd59f033-460c-4b88-a075-d4d3fedb6191",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:copeland:e3_supervisory_controller_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.31f01",
              "matchCriteriaId": "791AC7BF-A584-446A-A5FB-CB282430567A"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:copeland:site_supervisor_bx_860-1240:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "62991432-9156-4152-B940-4428A06ABBDA"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:copeland:site_supervisor_bxe_860-1245:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7281C06F-83DC-4A57-9076-B666C643B1A0"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:copeland:site_supervisor_cx_860-1260:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC339BFF-3123-4BE2-8092-3AD6FBB0AEFF"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:copeland:site_supervisor_cxe_860-1265:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C42AA549-5959-4E4D-81AD-9E04218EC157"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:copeland:site_supervisor_rx_860-1220:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F77BC1C-9709-40CB-AF4D-6A118D8F41E2"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:copeland:site_supervisor_rxe_860-1225:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F10BB44-439E-4823-8ECF-1700355C78E3"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:copeland:site_supervisor_sf_860-1200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B4909D80-1F06-437F-8D66-E39535B5E60D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.armis.com/research/frostbyte10/",
      "source": "dd59f033-460c-4b88-a075-d4d3fedb6191",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ]
    }
  ]
}