CVE-2025-52550

Firmware upgrade packages are unsigned

HIGH

7.2

CVSS Score

Published: September 2, 2025 at 11:26 AM UTC

Updated: June 17, 2026 at 09:36 AM UTC

2 products affected across 2 vendorsE3 Supervisory Controller FirmwareE3 Supervisory Control

Using E3 Supervisory Control by Copeland LP?

Get instant alerts when new vulnerabilities affect E3 Supervisory Control - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.2

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

E3 Supervisory Controller Firmware · Copeland

95%

v < 2.31f01

copeland-site-supervisor-bx-860-1240 (environment) · copeland-site-supervisor-bxe-860-1245 (environment) · copeland-site-supervisor-cx-860-1260 (environment) · copeland-site-supervisor-cxe-860-1265 (environment) · copeland-site-supervisor-rx-860-1220 (environment) · copeland-site-supervisor-rxe-860-1225 (environment) · copeland-site-supervisor-sf-860-1200 (environment)

E3 Supervisory Control · Copeland Lp

60%

v < 2.31F01

Affected range stops below 2.31F01, so it looks safe — our inference, not a vendor statement