Read the docs

Copeland

Records33All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical8CVSS 9.0–10.0
CVSS high22CVSS 7.0–8.9

Exploited now

Copeland records in CISA KEV

No Copeland vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Xweb 300d Pro Firmware 23 records MEDIUM Xweb 500b Pro Firmware 23 records MEDIUM Xweb 500d Pro Firmware 23 records MEDIUM E3 Supervisory Controller Firmware 9 records MEDIUM

Records

9 records in E3 Supervisory Controller Firmware · all components

TI-2025-32644 CVE-2025-52549 · GHSA-7v4f-5mr6-34c7

Predictable root linux password generation

Priority MEDIUM 48

E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00485 Published 2025-09-02 Fixed in 2.31F01 CWE-522
TI-2025-32645 CVE-2025-52550 · GHSA-9434-662f-57fm

Firmware upgrade packages are unsigned

Priority MEDIUM 45

E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00224 Published 2025-09-02 Fixed in 2.31F01 CWE-347
TI-2025-32642 CVE-2025-52547 · GHSA-6fvv-8447-rjph

DoS to the application services

Priority MEDIUM 44

E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00335 Published 2025-09-02 Fixed in 2.31F01 CWE-20
TI-2025-32639 CVE-2025-52544 · GHSA-2jf7-8fr3-3q7f

Arbitrary read file from the filesystem

Priority MEDIUM 44

E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00358 Published 2025-09-02 Fixed in 2.31F01 CWE-20
TI-2025-32640 CVE-2025-52545 · GHSA-xcg5-x6ph-w58q

Privilege escalation in the application services

Priority LOW 35

E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00264 Published 2025-09-02 Fixed in 2.31F01 CWE-522
TI-2025-32643 CVE-2025-52548 · GHSA-pf3m-qw97-hpvm

Enabling SSH and Shellinabox on the vulnerable machine

Priority LOW 30

E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00357 Published 2025-09-02 Fixed in 2.31F01 CWE-1242
TI-2025-32638 CVE-2025-52543 · GHSA-r764-c6vg-r345

Login to the application services using only the password hash

Priority LOW 24

E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00307 Published 2025-09-02 Fixed in 2.31F01 CWE-836
TI-2025-32641 CVE-2025-52546 · GHSA-phq4-pr85-3v44

Stored XSS by uploading a specially crafted floor plan file

Priority LOW 23

E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00203 Published 2025-09-02 Fixed in 2.31F01 CWE-434
Open these records in search →