Frostbyte10 Vulnerabilities Let Hackers Gain Remote Access

Armis Labs has uncovered ten critical security flaws collectively named “Frostbyte10” in Copeland’s E2 and E3 building management controllers, devices that handle refrigeration, HVAC, lighting and other essential functions. According to Armis Labs, these vulnerabilities could allow remote attackers to execute code, change settings, disable systems or steal sensitive data, with both the E2 end-of-life platform and the newer E3 system capable of being chained together for full, unauthenticated root access.

A firmware update is available now, with version 2.31F01 for E3 devices and equivalent updates for E2 controllers addressing all ten issues; affected organisations are urged to patch immediately, and E2 customers are advised to migrate to the E3 platform as E2 support ended in October 2024.

The article lists CVEs including CVE-2025-6519 (predictable default admin password “ONEDAY”) and CVE-2025-52551 (unauthenticated proprietary protocol permitting arbitrary file operations on E2 controllers), among others, each with severities and CVSS scores. Best practices recommended include applying the firmware updates, network segmentation, strong authentication, continuous monitoring, incident response planning, employee training and vendor collaboration. This combination of flaws and patch guidance highlights a real risk to food safety, supply chains and critical infrastructure if left unaddressed.