#VU107645 Insecure Default Initialization of Resource in Trio Q Licensed Data Radio - CVE-2025-2441

Vulnerability identifier: #VU107645

Vulnerability risk: Low

CVSSv4.0: 0.6 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-2441

CWE-ID: CWE-1188

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Trio Q Licensed Data Radio
Hardware solutions / Firmware

Vendor: Schneider Electric

Description

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to insecure default initialization of resource. An attacker with physical access can set the radio to factory default mode and cause the target product to not correctly initialize all data.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Trio Q Licensed Data Radio: before 2.7.2

---

External links
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-02.pdf
https://www.cisa.gov/news-events/ics-advisories/icsa-25-107-01

---

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.