Veille CVE

Recherche « Copeland LP E3 Supervisory Control »

6 CVE

Critique 1 Élevée 4 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Copeland LP E3 Supervisory Control » ✕
  1. CVE-2025-6519 9.8 Critique

    Copeland LP E3 Supervisory Control · Copeland e3 supervisory controller firmware

    E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.

  2. CVE-2025-52547 7.5 Élevée

    Copeland LP E3 Supervisory Control · Copeland e3 supervisory controller firmware

    E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services.

  3. CVE-2025-52546 6.1 Moyenne

    Copeland LP E3 Supervisory Control · Copeland e3 supervisory controller firmware

    E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can inject a stored XSS to the floorplan web page.

  4. CVE-2025-52545 7.5 Élevée

    Copeland LP E3 Supervisory Control · Copeland e3 supervisory controller firmware

    E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services.

  5. CVE-2025-52544 7.5 Élevée

    Copeland LP E3 Supervisory Control · Copeland e3 supervisory controller firmware

    E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system.

  6. CVE-2025-52543 7.5 Élevée

    Copeland LP E3 Supervisory Control · Copeland e3 supervisory controller firmware

    E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash.