CVE-2025-52548

Enabling SSH and Shellinabox on the vulnerable machine

MEDIUM

4.9

CVSS Score

Published: September 2, 2025 at 11:26 AM UTC

Updated: October 5, 2026 at 03:10 PM UTC

9 products affected across 2 vendorsE3 Supervisory Controller FirmwareSite Supervisor Sf 860-1200Site Supervisor Rxe 860-1225

Using E3 Supervisory Control by Copeland LP?

Get instant alerts when new vulnerabilities affect E3 Supervisory Control - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.9

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

E3 Supervisory Controller Firmware · Copeland

95%

v < 2.31f01

Affected range stops below 2.31f01, so it looks safe — our inference, not a vendor statement

copeland-site-supervisor-bx-860-1240 (environment) · copeland-site-supervisor-bxe-860-1245 (environment) · copeland-site-supervisor-cx-860-1260 (environment) · copeland-site-supervisor-cxe-860-1265 (environment) · copeland-site-supervisor-rx-860-1220 (environment) · copeland-site-supervisor-rxe-860-1225 (environment) · copeland-site-supervisor-sf-860-1200 (environment)

E3 Supervisory Control · Copeland Lp

60%

v < 2.31F01

Affected range stops below 2.31F01, so it looks safe — our inference, not a vendor statement

Site Supervisor Bx 860-1240 · Copelanddevice

80%

All versions

Site Supervisor Bxe 860-1245 · Copelanddevice

80%

All versions

Site Supervisor Cx 860-1260 · Copelanddevice

80%