CVE-2025-1058 Schneider Electric CVE debrief

Who should care

OT/ICS asset owners, plant and facilities teams, system integrators, network and firewall administrators, and incident responders responsible for Schneider Electric ASCO 5310/5350 remote annunciators.

Technical summary

The advisory describes a code-download integrity weakness in which malicious firmware may be accepted without sufficient integrity validation. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, indicating network-reachable impact, low attack complexity, required privileges, no user interaction, and high integrity and availability impact. The vendor and CISA references identify two affected product families: ASCO 5310 Single-Channel Remote Annunciator and ASCO 5350 Eight Channel Remote Annunciator, both listed as affected in all versions.

Defensive priority

High priority for any environment where these annunciators are reachable from operational, enterprise, or untrusted networks, because the advisory indicates a path to device inoperability and no fixed remediation was available at publication.

Recommended defensive actions

• Inventory all Schneider Electric ASCO 5310 and ASCO 5350 remote annunciators and confirm whether they are exposed to non-trusted networks.
• Place the devices in a protected environment and avoid any public internet exposure.
• Change default passwords on the annunciators to reduce unauthorized access risk.
• Segment the network and use firewall rules to block unauthorized access to port 80/HTTP.
• Apply vendor remediation when Schneider Electric releases it for future versions.
• Subscribe to Schneider Electric security notifications to receive advisory updates and remediation status.

Evidence notes

CISA CSAF advisory ICSA-25-077-05 and Schneider Electric security notice SEVD-2025-042-01 both describe the issue as CWE-494 and list the affected products as Schneider Electric ASCO 5310 Single-Channel Remote Annunciator and ASCO 5350 Eight Channel Remote Annunciator, all versions. The advisory states that malicious firmware downloads could render the device inoperable and that Schneider Electric was establishing a remediation plan for future versions. The mitigation text in the source specifically recommends protected deployment, password changes, network segmentation, and blocking unauthorized access to port 80/HTTP.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.