Cyber Resilience

CVE-2025-52543

Copeland E3 Supervisory Controller Firmware ≤ 2.31f01

Published
02 September 2025
Modified
17 June 2026
Patch / advisory
CVSS Score v4 5.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0030 22th percentile
Risk Priority 32 floored blend · peak EPSS

Summary

CVE-2025-52543 is a medium-severity Use of Password Hash Instead of Password for Authentication (CWE-836) vulnerability in Copeland E3 Supervisory Controller Firmware. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Pass the Hash (T1550.002); ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-5 (Authenticator Management) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1550.002 Pass the Hash Lateral Movement
Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls.
T1550 Use Alternate Authentication Material Lateral Movement
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-52549Same product: Copeland E3 Supervisory Controller Firmware
CVE-2025-6519Same product: Copeland E3 Supervisory Controller Firmware
CVE-2025-52545Same product: Copeland E3 Supervisory Controller Firmware
CVE-2025-52546Same product: Copeland E3 Supervisory Controller Firmware
CVE-2025-52550Same product: Copeland E3 Supervisory Controller Firmware
CVE-2025-52548Same product: Copeland E3 Supervisory Controller Firmware
CVE-2025-52544Same product: Copeland E3 Supervisory Controller Firmware
CVE-2025-52547Same product: Copeland E3 Supervisory Controller Firmware
CVE-2026-9222Shared CWE-836
CVE-2019-25552Shared CWE-836

Affected Assets

copeland
e3 supervisory controller firmware
≤ 2.31f01

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Requires proper identification and authentication of users, which structurally precludes accepting password hashes in place of passwords.

Authenticator management requires secure distribution, verification, and handling of passwords rather than allowing direct submission and comparison of hashes.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 mostly match
prevents

Proper authentication mechanisms require passwords (not pre-hashed values) to be supplied by the claimant and verified server-side.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

degrades

Directly requires secure handling and protection of authentication credentials, preventing storage or comparison of password hashes as if they were passwords.

degrades

Mandates secure authentication mechanisms that preclude the flawed practice of treating password hashes as authenticators.

degrades

Requires proper cryptographic practices for protecting passwords, indirectly mitigating misuse of hashes in authentication.

prevents

Secure coding guidance can prevent this implementation error but does not address the control's broader intent.

References