CVE-2025-52543 MEDIUM

CVE-2025-52543: Login to the application services using only the password hash

Vendor Copeland Lp
Product E3 Supervisory Control
Weakness CWE-836
Published September 2, 2025
Last update September 2, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:L

What the vulnerability does

01Description

E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash.

Key dates

02Disclosure timeline

September 2, 2025 CVE published
September 2, 2025 Record updated