CVE-2025-52547 DoS to the application services
An attacker can crash application services via an unvalidated API call in Copeland E3 Site Supervisor Control, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-52547?
CVE-2025-52547 is a high-severity denial of service vulnerability in Copeland LP E3 Supervisory Control, published on 2 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services.
Weakness: CWE-20
Which versions are affected by CVE-2025-52547?
It affects 1 product.
Products include Copeland E3 Supervisory Controller Firmware.
How do I fix CVE-2025-52547?
No fix has been published for CVE-2025-52547 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-52547 being exploited?
There is no known exploitation of CVE-2025-52547 in the wild and no public exploit code.
Other vulnerabilities in Copeland LP E3 Supervisory Control
- CVE-2025-6519 Consistent predictable generation of the password for the default admin user "ONEDAY" to the application services
- CVE-2025-52549 Predictable root linux password generation
- CVE-2025-52544 Arbitrary read file from the filesystem
- CVE-2025-52550 Firmware upgrade packages are unsigned
- CVE-2025-52545 Privilege escalation in the application services
Sources
Also known as GHSA-6fvv-8447-rjph.