CVE-2025-6519
📋 TL;DR
CVE-2025-6519 allows attackers to predictably generate the password for the default 'ONEDAY' admin account in E3 Site Supervisor firmware, granting administrative access. This affects all systems running firmware versions below 2.31F01. The vulnerability cannot be mitigated by deleting or modifying the ONEDAY user.
💻 Affected Systems
- E3 Site Supervisor
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full administrative compromise of the E3 Site Supervisor, allowing complete control over industrial control systems, potential disruption of critical infrastructure, and lateral movement to connected systems.
Likely Case
Unauthorized administrative access to the supervisory system, enabling configuration changes, data exfiltration, and potential manipulation of industrial processes.
If Mitigated
Limited impact if network segmentation prevents access to the vulnerable interface and strong authentication controls are in place elsewhere.
🎯 Exploit Status
Exploitation requires knowledge of the password generation algorithm, which has been publicly documented in the research. Attackers need network access to the management interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.31F01
Vendor Advisory: https://www.armis.com/research/frostbyte10/
Restart Required: Yes
Instructions:
1. Download firmware version 2.31F01 from the vendor. 2. Backup current configuration. 3. Apply the firmware update through the management interface. 4. Verify the update completed successfully. 5. Restart the device.
🔧 Temporary Workarounds
Network Segmentation
allIsolate the E3 Site Supervisor management interface from untrusted networks
Access Control Lists
allImplement strict network ACLs to limit access to the management interface to authorized IP addresses only
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the vulnerable system from all untrusted networks
- Deploy network monitoring and intrusion detection specifically for authentication attempts against the ONEDAY account
🔍 How to Verify
Check if Vulnerable:
Check the firmware version in the device web interface or CLI. If version is below 2.31F01, the system is vulnerable.Check Version:
Check via web interface at System > About, or via CLI command 'show version'Verify Fix Applied:
After patching, verify the firmware version shows 2.31F01 or higher and attempt to authenticate with the ONEDAY account using the old password generation method (should fail).📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts for ONEDAY user
- Successful logins from unusual IP addresses to ONEDAY account
- Configuration changes made by ONEDAY user
Network Indicators:
- Authentication requests to the management interface for ONEDAY user
- Traffic patterns indicating password guessing attempts
SIEM Query:
source="e3-supervisor" AND (user="ONEDAY" OR auth_failure="ONEDAY")