CVE-2025-52548

MediumCVSS 4.9/10Last modified Oct 5, 2026

Description

E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-1242

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2025
Last modified: Oct 5, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-525499.8E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An attacker can generate the root li CVE-2025-52554.8The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variable CVE-2025-525507.2E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upg CVE-2025-525519.3E2 Facility Management Systems use a proprietary protocol that allows for unauthenticated file operations on any file in the file system.CVE-2025-525526.1FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable to open redirect and CVE-2025-525539.6authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a sin CVE-2025-525544.3n8n is a workflow automation platform. Prior to version 1.99.1, an authorization vulnerability was discovered in the /rest/executions/:id/st CVE-2025-525556.5Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unp CVE-2025-525569.3rfc3161-client is a Python library implementing the Time-Stamp Protocol (TSP) described in RFC 3161. Prior to version 1.0.3, there is a flaw CVE-2025-525578.6Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript lead CVE-2025-525587.0changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Prior to vers CVE-2025-525595.4Zulip is an open-source team chat application. From versions 2.0.0-rc1 to before 10.4 in Zulip Server, the /digest/ URL of a server shows a