CVE-2025-6519

E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.

Scoring

Severity

CRITICAL

CVSS base score

9.3

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L

EPSS probability

0.52%

CWE

CWE-522

Published

2025-09-02

Last modified

2026-03-12

Affected products

• Copeland LP E3 Supervisory Control

Weakness type

• CWE-522

Related vulnerabilities

• CVE-2026-69805 — .NET Elevation of Privilege Vulnerability
• CVE-2026-64918 — Microsoft Office Spoofing Vulnerability
• CVE-2026-81381 — GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability
• CVE-2026-77909 — Azure CycleCloud Information Disclosure Vulnerability
• CVE-2026-82070 — Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface
• CVE-2026-86600 — Workload identity attestation generated before login host validation in Snowflake drivers
• CVE-2026-86726 — AVideo through 29.0 Information Disclosure via restreamsActive.json.php
• CVE-2026-61516 — Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint

Markdown version · Browse all CVEs