CVE-2025-52546:

CVE-2025-52546: Stored XSS in Copeland LP E3 Supervisory Control floor plan upload feature (firmware < 2.31F01); unauthenticated attacker can inject stored scripts via crafted floor plan files (CWE-434).

Score
A numerical rating that indicates how dangerous this vulnerability is.

6.1Medium

Published Date:Sep 2, 2025
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.1
EPSS Percentile:31%

Exploitability

Score:2.8
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:REQUIRED
Scope:CHANGED

Impact

Score:2.7
Confidentiality Impact:LOW
Integrity Impact:LOW
Availability Impact:NONE

Description Preview

Overview

This vulnerability description covers a stored cross-site scripting flaw in the floor plan upload feature of Copeland LP’s E3 Site Supervisor Control firmware prior to 2.31F01. An unauthenticated attacker can upload a crafted floor plan file that persists in the floorplan page, enabling the attacker to execute scripts in other users’ browsers when they view the floor plan. The issue is categorized as CWE-434 Unrestricted Upload of File with Dangerous Type and CAPEC-592 Stored XSS, and is exploitable over the network with low complexity and no privileges, requiring some user interaction. The vulnerability affects devices running firmware versions 0 through just under 2.31F01, and the listed mitigations focus on firmware upgrade and network-layer protections to reduce exposure.

Remediation

Upgrade the affected E3 Supervisory Controls firmware to a version greater than 2.30F1 (as recommended by the advisory).
Restrict network access to the device’s management/interface network (ETH 0) by placing the device behind a restricted VLAN or subnet and/or firewall, ensuring this network segment is not reachable from untrusted networks.
If possible, disable or tightly control the floor plan upload feature to reduce exposure, or require authenticated access and input validation for uploads.
Implement server-side validation and sanitization of uploaded content to prevent script payloads from being stored or executed.
After applying remediation, perform targeted testing to verify that crafted uploads no longer trigger stored XSS and monitor logs for upload anomalies.