PT-2025-35557 · Unknown · E3 Site Supervisor Control

Armis Labs · Published 2025-09-02 · Updated 2025-09-02 · CVE-2025-52548

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions E3 Site Supervisor Control versions prior to 2.31F01

Description E3 Site Supervisor Control (firmware version prior to 2.31F01) contains a hidden API call within the application services that enables SSH and Shellinabox. These services exist but are disabled by default. An attacker with administrative access to the application services can use this API to enable remote access to the underlying operating system.

Recommendations Update E3 Site Supervisor Control to version 2.31F01 or later.

Fix

Weakness Enumeration

CWE-1242

Related Identifiers

CVE-2025-52548

Affected Products

E3 Site Supervisor Control

References · 5

• https://osv.dev/vulnerability/CVE-2025-52548 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52548 · Security Note
• https://armis.com/research/frostbyte10 · Note
• https://t.me/CVEtracker/31502 · Telegram Post
• https://twitter.com/CVEnew/status/1962842479939428611 · Twitter Post