CVE-2025-6519

Consistent predictable generation of the password for the default admin user "ONEDAY" to the application services

State: Published
Severity: 9.3 Critical
Published: Sep 2, 2025
Updated: Sep 2, 2025
Reserved: Jun 23, 2025

Description

E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L	Armis

Weaknesses

CWE-522 Insufficiently Protected Credentials

Affected Products

Product	Versions
E3 Supervisory ControlCopeland LP	before 2.31F01Affected

References

https://www.armis.com/research/frostbyte10/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.