CVE-2025-52551

CVE Enrichment

CVSS: 9.3 CRITICAL
EPSS: 0.35%
EPSS Percentile: 28.51%
CISA KEV: Not listed

Description

E2 Facility Management Systems use a proprietary protocol that allows for unauthenticated file operations on any file in the file system.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: dd59f033-460c-4b88-a075-d4d3fedb6191
Published: 02-Sep-2025 19:15
Last Modified: 17-Jun-2026 16:36
EPSS Date: 2026-11-09
CWE: CWE-306

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:L /
                            SA:L /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CNA Products / Version Status

Copeland LP · E2 Facility Management System Source: CNA · dd59f033-460c-4b88-a075-d4d3fedb6191
Default status: affected

0 ≤ version ≤ <=4.11F02 — affected (firmware)

References

dd59f033-460c-4b88-a075-d4d3fedb6191

Last enrichment sync: 10-Nov-2026 07:40
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2025-6519, CVE-2025-52543 to CVE-2025-52551 (Frostbyte10) Copeland E3 Site Supervisor and E2 Ten flaws found by Armis that chain to unauthenticated remote code execution as root E3 firmware 2.31F01; E2 is end of life Refrigeration Controller Attacks Spread Across Countries, Attribution Remains Unclear

CVE (6)

Threat Actors (5)

MITRE ATT&CK (8)

Vendors (4)

Products (10)

Tools (1)

Industries (6)

Countries (9)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.