CVE-2025-52545 Privilege escalation in the application services

E3 Site Supervisor Control firmware version 2.31F01 RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services...

CVE-2025-52545

The CVE-2025-52545 entry describes the E3 Site Supervisor Control RCI service (firmware

CVE-2025-52544 Arbitrary read file from the filesystem

E3 Site Supervisor Control firmware version 2.31F01 has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system...

CVE-2025-52543 Login to the application services using only the password hash

E3 Site Supervisor Control firmware version 2.31F01 application services MGW and RCI uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash...

CVE-2025-52543

CVE-2025-52543 affects E3 Site Supervisor Control (firmware versions prior to 2.31F01) and its application services MGW/RCI. The root cause is use of client-side hashing for authentication, enabling an attacker to authenticate by obtaining only a password hash. Public references consistently desc...

PT-2025-35557

Name of the Vulnerable Software and Affected Versions: E3 Site Supervisor Control versions prior to 2.31F01 Description: E3 Site Supervisor Control firmware version prior to 2.31F01 contains a hidden API call within the application services that enables SSH and Shellinabox. These services exist b...

PT-2025-35554

Name of the Vulnerable Software and Affected Versions: E3 Site Supervisor Control versions prior to 2.31F01 Description: The RCI service in E3 Site Supervisor Control contains an API call that allows reading user information, including all usernames and password hashes for application services...

PT-2025-35553

Name of the Vulnerable Software and Affected Versions: E3 Site Supervisor Control versions prior to 2.31F01 Description: E3 Site Supervisor Control firmware version prior to 2.31F01 has a floor plan feature that allows an unauthenticated attacker to upload floor plan files. By uploading a special...

PT-2025-35558

Name of the Vulnerable Software and Affected Versions: E3 Site Supervisor Control versions prior to 2.31F01 Description: The E3 Site Supervisor Control generates the root Linux password on each boot. An attacker can generate the root Linux password for a vulnerable device based on known or easily...

PT-2025-35552

Name of the Vulnerable Software and Affected Versions: E3 Site Supervisor Control versions prior to 2.31F01 Description: The E3 Site Supervisor Control application services MGW and RCI utilize client-side hashing for authentication. This allows an attacker to authenticate by obtaining only the...

PT-2025-35556

Name of the Vulnerable Software and Affected Versions: E3 Site Supervisor Control versions prior to 2.31F01 Description: E3 Site Supervisor Control firmware version prior to 2.31F01 MGW contains an API call lacking input validation. An attacker can use this command to continuously crash the...

Language-Based Security and Time-Inserting Supervisor

Algebraic methods are employed in order to define language-based security properties of processes. A supervisor is introduced that can disable unwanted behavior of an insecure process by controlling some of its actions or by inserting timed actions to make an insecure process secure. We assume a...