CVE-2025-52548
Copeland E3 Supervisory Controller Firmware ≤ 2.31f01
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-52548 is a medium-severity Inclusion of Undocumented Features or Chicken Bits (CWE-1242) vulnerability in Copeland E3 Supervisory Controller Firmware. Its CVSS base score is 6.9 (Medium).
Operationally, ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-7 (Least Functionality) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28445
Vulnerability Data
E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize…
more
this API to enable remote access to the underlying OS.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.3.4
Mitigating Controls (NIST 800-53 r5) AI
Least-functionality configuration can disable or remove non-essential capabilities once discovered, limiting the blast radius of any undocumented chicken bits that remain.
Documented development standards and processes directly require that all device features be specified and recorded, preventing hidden chicken bits from being introduced.
An SDLC that incorporates security requires all features to be captured in requirements and design artifacts, stopping undocumented capabilities from being added.
Security engineering principles applied during design explicitly call for complete, documented functionality and the avoidance of hidden or undeclared mechanisms.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can uncover undocumented functionality before release.
Secure development life cycle requires documented design and review, reducing hidden or undocumented features.
Secure system architecture and engineering principles mandate documented, minimal, and auditable designs, limiting chicken bits.
Secure coding standards and peer review detect and prohibit undocumented or debug features.
Change management processes require documented approvals, reducing the chance of hidden features being introduced.
Configuration management enforces documented, approved configurations, limiting undocumented hardware or firmware features.