SB2025042232 - Multiple vulnerabilities in Schneider Electric Trio Q Licensed Data Radio

Description

This security bulletin contains information about 3 vulnerabilities.

1) Insecure Storage of Sensitive Information (CVE-ID: CVE-2025-2440)

CWE-ID: CWE-922 - Insecure Storage of Sensitive Information

CVSSv4: CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to insecure storage of sensitive information. An attacker with physical access can set the radio to factory default mode and gain access to confidential data.

2) Insecure Default Initialization of Resource (CVE-ID: CVE-2025-2441)

CWE-ID: CWE-1188 - Insecure Default Initialization of Resource

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to insecure default initialization of resource. An attacker with physical access can set the radio to factory default mode and cause the target product to not correctly initialize all data.

3) Insecure Default Initialization of Resource (CVE-ID: CVE-2025-2442)

CWE-ID: CWE-1188 - Insecure Default Initialization of Resource

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to insecure default initialization of resource. An attacker with physical access can set the radio to factory default mode and execute arbitrary code on the system.

Remediation

Install update from vendor's website.

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-02.pdf
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-107-01