CVE-2025-6519:
Critical vulnerability in Copeland LP E3 Supervisory Control firmware (< 2.31F01) where a default admin user "ONEDAY" uses a daily generated password that can be predicted by an attacker; the ONEDAY account cannot be deleted or modified.
Score
A numerical rating that indicates how dangerous this vulnerability is.
9.8Critical- Published Date:Sep 2, 2025
- CISA KEV Date:*No Data*
- Industries Affected:20
Threat Predictions
- EPSS Score:0.1
- EPSS Percentile:21%
Exploitability
- Score:3.9
- Attack Vector:NETWORK
- Attack Complexity:LOW
- Privileges Required:NONE
- User Interaction:NONE
- Scope:UNCHANGED
Impact
- Score:5.9
- Confidentiality Impact:HIGH
- Integrity Impact:HIGH
- Availability Impact:HIGH
Description Preview
Critical vulnerability in Copeland LP E3 Supervisory Control firmware (< 2.31F01) where a default admin user "ONEDAY" uses a daily generated password that can be predicted by an attacker; the ONEDAY account cannot be deleted or modified.
Overview
Copeland LP’s E3 Supervisory Control firmware versions before 2.31F01 contain a default admin account named ONEDAY whose password is generated daily in a predictable manner. Because credentials are managed in a way that can be anticipated by an attacker, unauthenticated network attackers could obtain admin access, potentially compromising the system’s confidentiality, integrity, and availability. The ONEDAY account cannot be deleted or modified by any user, making remediation more challenging. The vulnerability is categorized under insufficiently protected credentials and is exploitable over the network with no user interaction.
Remediation
- 1) Upgrade firmware to a version greater than 2.30F1 (as referenced in the advisory), effectively moving beyond the affected < 2.31F01 range. 2) If immediate upgrading is not feasible, restrict network exposure by isolating the E3 Supervisory Control interface (ETH 0) using a restricted VLAN or subnet and enforce firewall rules so this interface is not reachable from untrusted networks. 3) After applying the upgrade, verify that the vulnerability is mitigated by checking vendor release notes and confirming that the default ONEDAY credentials are no longer a risk (or that the password generation mechanism is fixed). 4) Implement additional hardening: disable or tightly control remote management where possible, enforce network segmentation for critical control devices, and enable monitoring/auditing of authentication attempts to detect any unauthorized access attempts.
References
Industries Affected
Below is a list of industries most commonly impacted or potentially at risk based on intelligence.
