CVE-2025-52545
📋 TL;DR
CVE-2025-52545 allows attackers to retrieve all usernames and password hashes via an API call in the RCI service of E3 Site Supervisor Control. This affects systems running firmware versions below 2.31F01, potentially exposing authentication credentials for application services.
💻 Affected Systems
- E3 Site Supervisor Control
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete credential compromise leading to unauthorized access, privilege escalation, lateral movement, and potential system takeover across all application services.
Likely Case
Credential harvesting enabling unauthorized access to application services, potentially leading to data theft or manipulation.
If Mitigated
Limited exposure if strong network segmentation and access controls prevent external or unauthorized internal access to the vulnerable API.
🎯 Exploit Status
Exploitation involves a simple API call to the RCI service; no authentication required based on description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.31F01 or later
Vendor Advisory: https://www.armis.com/research/frostbyte10/
Restart Required: Yes
Instructions:
1. Download firmware version 2.31F01 or later from vendor. 2. Backup current configuration. 3. Apply firmware update via management interface. 4. Reboot device. 5. Verify version update.
🔧 Temporary Workarounds
Disable RCI Service
allDisable the vulnerable RCI service if not required for operations.
Check vendor documentation for specific disable commands
Network Segmentation
allRestrict network access to the RCI service using firewall rules.
iptables -A INPUT -p tcp --dport [RCI_PORT] -j DROP
netsh advfirewall firewall add rule name="Block RCI" dir=in action=block protocol=TCP localport=[RCI_PORT]
🧯 If You Can't Patch
- Implement strict network access controls to limit RCI service exposure to trusted IPs only.
- Monitor network traffic to the RCI service for unauthorized access attempts and credential extraction patterns.
🔍 How to Verify
Check if Vulnerable:
Check firmware version via device management interface; if version is below 2.31F01, system is vulnerable.Check Version:
Check via device CLI or web interface; specific command varies by vendor implementation.Verify Fix Applied:
Confirm firmware version is 2.31F01 or later after update; test API call to RCI service to ensure it no longer returns credential data.📡 Detection & Monitoring
Log Indicators:
- Unusual API calls to RCI service
- Multiple failed authentication attempts following credential exposure
Network Indicators:
- HTTP requests to RCI service endpoints from unauthorized sources
- Traffic patterns indicating credential harvesting
SIEM Query:
source="device_logs" AND (event="RCI_API_call" OR event="credential_access")