What’s Vulnerable › Vulnerabilities
CVE-2025-52548: Enabling SSH and Shellinabox on the vulnerable machine
- Severity: medium (CVSS 4.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-09-02 · updated 2026-10-05
- Weakness: CWE-1242
Description
E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.
Affected products
- Copeland LP E3 Supervisory Control: before 2.31f01 — fixed in 2.31f01
How to fix
Upgrade to a fixed version: Copeland LP E3 Supervisory Control 2.31f01. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-52548 or the next vulnerability affects your stack