CVE-2025-52548: Copeland e3 Supervisory Controller Firmware

Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days.

E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.

Affected products

• Copeland e3 Supervisory Controller Firmware: before 2.31f01 (fixed in 2.31f01)

Published 2025-09-02. Last modified 2026-10-05.