{"id":"CVE-2025-52550","aliases":["EUVD-2025-26398","GHSA-9434-662f-57fm"],"status":"published","title":"Firmware upgrade packages are unsigned","description":"E3 Site Supervisor Control (firmware version \u003c 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00224,"percentile":0.13179,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-347"],"published":"2025-09-02T11:26:35Z","modified":"2026-06-17T09:36:39Z","products":[{"vendor":"copeland","product":"e3_supervisory_controller_firmware"},{"vendor":"copeland lp","product":"e3 supervisory control"}],"references":[{"url":"https://www.armis.com/research/frostbyte10/","tags":["Mitigation","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52550"},{"url":"https://www.armis.com/research/frostbyte10"},{"url":"https://github.com/advisories/GHSA-9434-662f-57fm"}],"sources":{"cve":[{"id":"CVE-2025-52550","title":"Firmware upgrade packages are unsigned","description":"E3 Site Supervisor Control (firmware version \u003c 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade.","status":"published","published":"2025-09-02T11:26:35.207Z","modified":"2025-09-02T13:40:43.018Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:32:31.309974Z"}],"euvd":[{"id":"EUVD-2025-26398","description":"E3 Site Supervisor Control (firmware version \u003c 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade.","status":"published","published":"2025-09-02T11:26:35Z","modified":"2025-09-02T13:40:43Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L","level":"high"}],"updated_at":"2026-11-02T20:31:48.787221Z"}],"ghsa":[{"id":"GHSA-9434-662f-57fm","title":"E3 Site Supervisor Control (firmware version \u003c 2.31F01) firmware upgrade packages are unsigned....","description":"E3 Site Supervisor Control (firmware version \u003c 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade.","status":"published","published":"2025-10-01T18:30:38Z","modified":"2025-10-01T18:30:46Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:03:49.634332Z"}],"nvd":[{"id":"CVE-2025-52550","description":"E3 Site Supervisor Control (firmware version \u003c 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade.","status":"published","published":"2025-09-02T12:15:37.747Z","modified":"2026-06-17T09:36:39.49Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:11:26.200344Z"}]}}