#VU107654 Insecure Default Initialization of Resource in Trio Q Licensed Data Radio - CVE-2025-2442

Vulnerability identifier: #VU107654

Vulnerability risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-2442

CWE-ID: CWE-1188

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Trio Q Licensed Data Radio
Hardware solutions / Firmware

Vendor: Schneider Electric

Description

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to insecure default initialization of resource. An attacker with physical access can set the radio to factory default mode and execute arbitrary code on the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Trio Q Licensed Data Radio: before 2.7.2

---

External links
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-02.pdf
https://www.cisa.gov/news-events/ics-advisories/icsa-25-107-01

---

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.