Enabling SSH and Shellinabox on the vulnerable machine
Summary
| CVE | CVE-2025-52548 |
|---|---|
| State | PUBLISHED |
| Assigner | Armis |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-09-02 12:15:37 UTC |
| Updated | 2026-09-30 23:10:00 UTC |
| Description | E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS. |
Risk And Classification
Primary CVSS: v4.0 6.9 MEDIUM from dd59f033-460c-4b88-a075-d4d3fedb6191
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.003410000 probability, percentile 0.252750000 (date 2026-10-05)
Problem Types: CWE-1242 | CWE-1242 CWE-1242
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | dd59f033-460c-4b88-a075-d4d3fedb6191 | Secondary | 6.9 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 6.9 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Primary | 4.9 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Copeland | E3 Supervisory Controller Firmware | All | All | All | All |
| Hardware | Copeland | Site Supervisor Bxe 860-1245 | - | All | All | All |
| Hardware | Copeland | Site Supervisor Bx 860-1240 | - | All | All | All |
| Hardware | Copeland | Site Supervisor Cxe 860-1265 | - | All | All | All |
| Hardware | Copeland | Site Supervisor Cx 860-1260 | - | All | All | All |
| Hardware | Copeland | Site Supervisor Rxe 860-1225 | - | All | All | All |
| Hardware | Copeland | Site Supervisor Rx 860-1220 | - | All | All | All |
| Hardware | Copeland | Site Supervisor Sf 860-1200 | - | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Copeland LP | E3 Supervisory Control | affected 2.31F01 firmware | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.armis.com/research/frostbyte10 | dd59f033-460c-4b88-a075-d4d3fedb6191 | www.armis.com | Mitigation, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Armis Labs (en)
Additional Advisory Data
Solutions
CNA: Upgrade firmware of affected E3 Supervisory Controls to a version > 2.30F1.
Workarounds
CNA: Restrict access to the E3 Supervisory Controls network interface (ETH 0) by use of restricted VLAN or subnet and / or network firewall. Ensure the restricted VLAN or subnet is never accessible from untrusted networks.