Copeland LP vulnerabilities

CVE-2025-6519 Critical · 9.8 CWE-522 Sep 2, 2025

Consistent predictable generation of the password for the default admin user "ONEDAY" to the application services

E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.

CVE-2025-52547 High · 7.5 CWE-20 Sep 2, 2025

DoS to the application services

E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services.

CVE-2025-52546 Medium · 6.1 CWE-434 Sep 2, 2025

Stored XSS by uploading a specially crafted floor plan file

E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can inject a stored XSS to the floorplan web page.

CVE-2025-52545 High · 7.5 CWE-522 Sep 2, 2025

Privilege escalation in the application services

E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services.

CVE-2025-52544 High · 7.5 CWE-20 Sep 2, 2025

Arbitrary read file from the filesystem

E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system.

CVE-2025-52543 High · 7.5 CWE-836 Sep 2, 2025

Login to the application services using only the password hash

E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash.