VULNERABILITY INTELLIGENCE

CVE-2025-52548

CVSS score4.9 MEDIUM
EPSS probability0.36%
CISA KEVNot currently listed
Published2025-09-02
Last modified2026-10-05
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Description

E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.

Weakness classification

  • dd59f033-460c-4b88-a075-d4d3fedb6191: CWE-1242

Primary references