SB2025042232 - Multiple vulnerabilities in Schneider Electric Trio Q Licensed Data Radio

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Insecure Storage of Sensitive Information (CVE-ID: CVE-2025-2440)

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to insecure storage of sensitive information. An attacker with physical access can set the radio to factory default mode and gain access to confidential data.

2) Insecure Default Initialization of Resource (CVE-ID: CVE-2025-2441)

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to insecure default initialization of resource. An attacker with physical access can set the radio to factory default mode and cause the target product to not correctly initialize all data.

3) Insecure Default Initialization of Resource (CVE-ID: CVE-2025-2442)

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to insecure default initialization of resource. An attacker with physical access can set the radio to factory default mode and execute arbitrary code on the system.

Remediation

Install update from vendor's website.

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-02.pdf
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-107-01