Frostbyte10: The Critical Flaws Threatening Global Supply Chains

Researchers at Armis Labs have uncovered ten severe vulnerabilities in Copeland E2 and E3 controllers, devices used to manage HVAC, refrigeration, lighting and other building systems, collectively named Frostbyte10. According to Armis Labs, the flaws range from predictable admin password generation to remote code execution and unauthenticated file operations, with potential to allow attackers to manipulate system parameters, disable functions or gain root access.

Among the most serious issues are CVE-2025-6519 (CVSS 9.3) for a default “ONEDAY” admin password, CVE-2025-52548 (CVSS 9.2) for predictable Linux root password generation on boot, and CVE-2025-52551 (CVSS 9.3) involving a proprietary E2 protocol enabling unauthenticated file operations. Armis notes fixes are now available, advising organisations to patch affected devices, and mentions that Copeland E2 controllers have reached end-of-life (October 2024) with migration to the E3 platform recommended.

The report also highlights stored XSS, DoS in application services and unsigned firmware upgrades as part of the expanded attack surface, emphasising risks to food safety and global supply chains. According to Armis, patching is essential to mitigate the severity and impact of these vulnerabilities.