CVE-2025-52545

HIGH · 7.5 CVSS Gepubliceerd: 02-09-2025 CWE-522

Beschrijving

E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services.

Vendors

Copeland

Affected products

E3 Supervisory Controller Firmware Site Supervisor Bx 860-1240 Site Supervisor Bxe 860-1245 Site Supervisor Cx 860-1260 Site Supervisor Cxe 860-1265 Site Supervisor Rx 860-1220 Site Supervisor Rxe 860-1225 Site Supervisor Sf 860-1200

References

www.armis.com