Insecure Storage of Sensitive Information in Trio Q Licensed Data Radio - CVE-2025-2440
Published: April 22, 2025
Vulnerability identifier: #VU107644
CSH Severity: Low
CVSS v4: 4.1 [CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-2440
CWE-ID: CWE-922
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to compromise the target system.
The vulnerability exists due to insecure storage of sensitive information. An attacker with physical access can set the radio to factory default mode and gain access to confidential data.
Affected software
Trio Q Licensed Data Radio
How to mitigate CVE-2025-2440
Install updates from vendor's website.
Trio Q Licensed Data Radio - update to 2.7.2