Critical · 9.3 CVE-2025-6519 EUVD-2025-28745GHSA-48q9-vxr9-j39f

Consistent predictable generation of the password for the default admin user "ONEDAY" to the application services

Published Sep 2, 2025 · Updated Sep 2, 2025 · Assigned by Armis

Vendor: Copeland LP Product: E3 Supervisory Control

Description

E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.

Affected products

Vendor	Product	Affected	Fixed
Copeland LP	E3 Supervisory Control	< 2.31F01	2.31F01

References

https://www.armis.com/research/frostbyte10/