CVE-2025-6519 is a critical (CVSS 9.8) flaw in Copeland E3 Site Supervisor firmware before version 2.31F01. A default admin user named ONEDAY has a daily generated password that an attacker can predict, and the account cannot be deleted or changed. Update the firmware and keep the devices off the internet.
What's affected
The record lists the Copeland E3 Supervisory Controller firmware and the Site Supervisor models BX 860-1240, BXE 860-1245, CX 860-1260, CXE 860-1265, RX 860-1220, RXE 860-1225 and SF 860-1200, all with firmware before 2.31F01.
The description is short and clear. These devices have a default administrator account named ONEDAY with a password that is generated daily. An attacker can predict the password. The account cannot be deleted or modified by any user, so an operator cannot remove it with settings alone.
The record scores it CVSS 3.1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The only reference in the record is a research page from Armis. I could not retrieve that page, which returned a 403 error when I tried, and I could not find a vendor advisory I could fetch. This post therefore relies on the record. Check Copeland's own notices for the exact fixed build for your model before you plan the work.
How to check if you're exposed
Check the firmware version on each controller from its web interface or from the local display. Anything before 2.31F01 is in scope according to the record.
Then find out where the devices are reachable from. Building and refrigeration controllers are often reachable by a remote support path that nobody remembers. Review firewall rules, port forwards and any vendor remote access tools. Search your network scans for web interfaces on these controllers.
If you cannot tell which sites run which firmware, ask your service contractors for a list.
What to do now
- Update the firmware to 2.31F01 or later, using the vendor's procedure for your model.
- Remove these devices from the internet. Put them on a segmented network and reach them only through a VPN.
- Restrict which internal hosts can reach the web interface.
- Review access logs and device configuration for signs of unexpected logins, and compare setpoints with what you expect.
- Check the vendor's notices for guidance on this account, because settings changes cannot remove it according to the record.
Why it matters
The weakness is CWE-522, insufficiently protected credentials. A password that follows a rule an outsider can work out is not a secret, whether the rule is a date, a serial number or a counter. A hidden account that cannot be removed makes it worse, because defenders cannot reduce the risk by changing their own settings.
Building and refrigeration controllers run physical systems, and a takeover can affect food safety and operations. These are assets that rarely appear in vulnerability management tools. Put them in your inventory. The record does not say this flaw was exploited in the wild, and the KEV flag is false. The free Safeguard dependency scan can list the packages in a project and flag known CVEs, and the Gold directory keeps a page for each one.
Quick check
Can I just change the ONEDAY password?
The record says the account cannot be deleted or modified by any user. Update the firmware and restrict network access.
Where is the vendor advisory?
I could not retrieve one. The record points to a research page that returned an error. Check the vendor's security notices directly.
Sources
Last reviewed: 18 October 2026.
