Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: Copeland Component: E3 Supervisory Controller Firmware Clear all filters
TI-2025-32645 CVE-2025-52550 · GHSA-9434-662f-57fm

Firmware upgrade packages are unsigned

Priority MEDIUM 45

E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00224 Published 2025-09-02 Fixed in 2.31F01 CWE-347
TI-2025-32644 CVE-2025-52549 · GHSA-7v4f-5mr6-34c7

Predictable root linux password generation

Priority MEDIUM 48

E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00485 Published 2025-09-02 Fixed in 2.31F01 CWE-522
TI-2025-32643 CVE-2025-52548 · GHSA-pf3m-qw97-hpvm

Enabling SSH and Shellinabox on the vulnerable machine

Priority LOW 30

E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00357 Published 2025-09-02 Fixed in 2.31F01 CWE-1242
TI-2025-32642 CVE-2025-52547 · GHSA-6fvv-8447-rjph

DoS to the application services

Priority MEDIUM 44

E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00335 Published 2025-09-02 Fixed in 2.31F01 CWE-20
TI-2025-32641 CVE-2025-52546 · GHSA-phq4-pr85-3v44

Stored XSS by uploading a specially crafted floor plan file

Priority LOW 23

E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00203 Published 2025-09-02 Fixed in 2.31F01 CWE-434
TI-2025-32640 CVE-2025-52545 · GHSA-xcg5-x6ph-w58q

Privilege escalation in the application services

Priority LOW 35

E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00264 Published 2025-09-02 Fixed in 2.31F01 CWE-522
TI-2025-32639 CVE-2025-52544 · GHSA-2jf7-8fr3-3q7f

Arbitrary read file from the filesystem

Priority MEDIUM 44

E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00358 Published 2025-09-02 Fixed in 2.31F01 CWE-20
TI-2025-32638 CVE-2025-52543 · GHSA-r764-c6vg-r345

Login to the application services using only the password hash

Priority LOW 24

E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00307 Published 2025-09-02 Fixed in 2.31F01 CWE-836