Copeland Site Supervisor BX 860-1240
Approved changes feed: RSS · Atom
cpe:2.3:h:copeland:site_supervisor_bx_860-1240:-:*:*:*:*:*:*:*
part: h version: - update: *
| Vendor | Copeland (0337f2ca-87d7-5998-8541-ed674a0ef7b2) |
|---|---|
| Product | Site Supervisor Bx 860 1240 (ebaccb91-c173-5bf7-ac0f-85c45579b508) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-6519 |
not_vulnerable | 2026-06-08 07:43:15.205844 |
Consistent predictable generation of the password for the default admin user "ONEDAY" to the application services
E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.
Published: 2025-09-02T11:23:59.838Z
Updated: 2025-09-02T15:25:44.338Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52550 |
not_vulnerable | 2026-06-08 07:31:11.796277 |
Firmware upgrade packages are unsigned
E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade.
Published: 2025-09-02T11:26:35.207Z
Updated: 2025-09-02T13:40:43.018Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52549 |
not_vulnerable | 2026-06-08 07:31:11.795303 |
Predictable root linux password generation
E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An attacker can generate the root linux password for a vulnerable device based on known or easy to fetch parameters.
Published: 2025-09-02T11:26:23.423Z
Updated: 2025-09-02T13:43:26.506Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52548 |
not_vulnerable | 2026-06-08 07:31:11.794625 |
Enabling SSH and Shellinabox on the vulnerable machine
E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.
Published: 2025-09-02T11:26:08.636Z
Updated: 2025-09-02T13:28:08.207Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52547 |
not_vulnerable | 2026-06-08 07:31:11.793739 |
DoS to the application services
E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services.
Published: 2025-09-02T11:25:54.718Z
Updated: 2025-09-02T13:29:17.409Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52546 |
not_vulnerable | 2026-06-08 07:31:11.792827 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52545 |
not_vulnerable | 2026-06-08 07:31:11.792085 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52544 |
not_vulnerable | 2026-06-08 07:31:11.791236 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52543 |
not_vulnerable | 2026-06-08 07:31:11.786756 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.