Enabling SSH and Shellinabox on the vulnerable machine_CVE-2025-52548

6.9 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Description

E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.

Basic Information

ID CVE-2025-52548

Source Armis

Published Sep 2, 2025 at 11:26

Affected Product

Vendor Copeland LP

Product E3 Supervisory Control

Affected Versions Copeland LP E3 Supervisory Control 0

CWE Classification

CWE-1242

References

www.armis.com /research/frostbyte10/

{
    "lastseen": "",
    "description": "E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.",
    "published": "2025-09-02T11:26:08.636Z",
    "modified": "2025-09-02T11:26:08.636Z",
    "type": "cve",
    "title": "Enabling SSH and Shellinabox on the vulnerable machine",
    "source": "Armis",
    "references": "https://www.armis.com/research/frostbyte10/",
    "id": "CVE-2025-52548",
    "bulletinFamily": "",
    "cwe": [
        "CWE-1242"
    ],
    "cvelist": null,
    "sourceData": "Copeland LP E3 Supervisory Control 0",
    "sourceHref": "",
    "cvss": {
        "score": 6.9,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "E3 Supervisory Control",
    "version": "0",
    "vendor": "Copeland LP",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}