PatchTheCVEe3 supervisory controller firmware vulnerabilities and fixes
Recent CVEs affecting e3 supervisory controller firmware, with upgrade or downgrade steps. 6 tracked.
e3 supervisory controller firmware has 6 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 6. Most recent: 2025-09-02. Highest priority: CVE-2025-6519 (score 50/100).
- CVE-2025-52547 HIGH 7.5 UPGRADE E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation
- CVE-2025-52546 MEDIUM 6.1 UPGRADE E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenti
- CVE-2025-6519 CRITICAL 9.8 UPGRADE E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated passw
- CVE-2025-52544 HIGH 7.5 UPGRADE E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenti
- CVE-2025-52543 HIGH 7.5 UPGRADE E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side ha
- CVE-2025-52545 HIGH 7.5 UPGRADE E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, w
FAQ
How do I fix e3 supervisory controller firmware vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is e3 supervisory controller firmware being exploited right now?
None of the tracked e3 supervisory controller firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which e3 supervisory controller firmware CVE should I patch first?
CVE-2025-6519 currently ranks highest (50/100): E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated passw.