https://vulnogram.org/ Most recent CVEs assigned by Armis, Inc. (armis). https://vulnogram.org/seaview/icons/armis.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2025-52551 https://vulnogram.org/CVE-2025-52551 E2 Facility Management Systems use a proprietary protocol that allows for unauthenticated file operations on any file in the file system. Critical Network Exploitable Tue, 02 Sep 2025 11:30:14 GMT https://vulnogram.org/CVE-2025-52550 https://vulnogram.org/CVE-2025-52550 E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgr… High Tue, 02 Sep 2025 11:26:35 GMT https://vulnogram.org/CVE-2025-52549 https://vulnogram.org/CVE-2025-52549 E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An attacker can generate the root linux password for a vulnerable device based on known or easy to fetch parameters. Critical Network Exploitable Tue, 02 Sep 2025 11:26:23 GMT https://vulnogram.org/CVE-2025-52548 https://vulnogram.org/CVE-2025-52548 E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can ut… Medium Tue, 02 Sep 2025 11:26:08 GMT https://vulnogram.org/CVE-2025-52547 https://vulnogram.org/CVE-2025-52547 E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services. High Network Exploitable Tue, 02 Sep 2025 11:25:54 GMT https://vulnogram.org/CVE-2025-52546 https://vulnogram.org/CVE-2025-52546 E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can inject a stored XSS to the floo… Medium Network Exploitable Tue, 02 Sep 2025 11:25:39 GMT https://vulnogram.org/CVE-2025-52545 https://vulnogram.org/CVE-2025-52545 E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services. High Tue, 02 Sep 2025 11:25:22 GMT https://vulnogram.org/CVE-2025-52544 https://vulnogram.org/CVE-2025-52544 E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 fil… High Network Exploitable Tue, 02 Sep 2025 11:25:01 GMT https://vulnogram.org/CVE-2025-52543 https://vulnogram.org/CVE-2025-52543 E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash. Medium Tue, 02 Sep 2025 11:24:32 GMT https://vulnogram.org/CVE-2025-6519 https://vulnogram.org/CVE-2025-6519 E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user. Critical Network Exploitable Tue, 02 Sep 2025 11:23:59 GMT