Skip to content
OpenAdvisories

Vendor

Copeland LP

10 known vulnerabilities.

Products

E3 Supervisory Control 9 E2 Facility Management System 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.6
    CVE-2025-52550

    Firmware upgrade packages are unsigned

    E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade.

    Copeland LP E3 Supervisory Control
  • High 8.7
    CVE-2025-52547

    DoS to the application services

    E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services.

    Copeland LP E3 Supervisory Control
  • High 7.7
    CVE-2025-52545

    Privilege escalation in the application services

    E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services.

    Copeland LP E3 Supervisory Control
  • High 8.8
    CVE-2025-52544

    Arbitrary read file from the filesystem

    E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system.

    Copeland LP E3 Supervisory Control