CVE-2025-52549 is a critical weak credential flaw (CVSS 9.8) in Copeland E3 Site Supervisor Control firmware before 2.31F01. The device generates its root Linux password on each boot from values an attacker can learn. Update to 2.31F01 or later and keep the controllers off untrusted networks.
What's affected
The CVE record says E3 Site Supervisor Control firmware versions before 2.31F01 generate the root Linux password on each boot, and that an attacker can generate the password for a vulnerable device from known or easy to fetch parameters. The record lists the Copeland E3 supervisory controller firmware and the Site Supervisor models BX 860-1240, BXE 860-1245, CX 860-1260, CXE 860-1265, RX 860-1220, RXE 860-1225 and SF 860-1200.
The weakness is CWE-522 (insufficiently protected credentials). The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and the record does not say it is exploited in the wild. The fix is the 2.31F01 firmware, going by the affected range in the record. The reference in the record is the Armis research page on this group of flaws, titled FrostByte10 in its address, which could not be retrieved here, so check the Copeland advisory for the final version guidance.
How to check if you're exposed
Check the firmware version in the controller's web interface or in the system information screen, and compare it with 2.31F01. Anything older is in the affected range.
Then work out how the controllers are reached. Supervisors like this usually manage refrigeration and HVAC across stores or sites, and are often connected through a VPN, a cellular modem or a direct public address. Ask the networking team for a list of any rules that expose them.
Search your network inventory for these model numbers. Facilities teams often own and install them outside the normal IT asset process, so a controller can exist on your network without an entry in any inventory. A short conversation with facilities can reveal devices a scanner will miss.
What to do now
- Build a list of all Copeland E3 and Site Supervisor controllers, with firmware versions and site locations.
- Check the Copeland advisory for the fixed firmware and the update procedure for each model.
- Update affected controllers to 2.31F01 or later, scheduling it with the facilities team.
- Remove any direct internet exposure. Put the controllers behind a VPN and a firewall that allows only named management hosts.
- Segment them from business networks and from each other where possible.
- Review remote access and login logs for the controllers and ask whether any unknown party has accessed them.
Why it matters
A root password that is derived from facts about the device, instead of a random secret, is no real secret. If the inputs are known or easy to fetch, anyone who understands the scheme can work out the password for any device. That turns one device's firmware into a skeleton key for every unit running it.
The effect is bigger because of what these devices do. Site supervisors control refrigeration, heating and cooling equipment. Root access is not just a data issue. It can affect temperature control and the products that depend on it, so treat the physical consequences as part of the risk.
Operational technology is also slow to patch. Firmware updates need planned visits or maintenance windows, so network controls such as segmentation and VPN only access often have to carry the load for weeks. Use them now, then schedule the update.
Quick check
Which firmware fixes CVE-2025-52549?
The record says versions before 2.31F01 are affected, so 2.31F01 or later is the target. Confirm the exact guidance for each model in the Copeland advisory.
Can I mitigate it without updating?
Network controls reduce risk: no public exposure, VPN only access and segmentation. They do not fix the weak password scheme, so plan the update.
Sources
- Safeguard Gold record: https://gold.safeguard.sh/vulnerability/CVE-2025-52549
- Armis research page FrostByte10, listed in the CVE record (https://www.armis.com/research/frostbyte10/). The page did not load when fetched, so affected models and versions come from the record.
Last reviewed: 18 October 2026.
