CVE-2025-1060 Schneider Electric CVE debrief

Who should care

OT/ICS operators, plant engineers, network/security teams, and asset owners responsible for Schneider Electric ASCO 5310 or ASCO 5350 remote annunciators—especially if the devices are reachable from untrusted networks or rely on HTTP/port 80.

Technical summary

The advisory identifies a CWE-319 cleartext transmission issue in Schneider Electric ASCO 5310 and ASCO 5350 remote annunciators. The vendor states that network traffic sniffing could expose data, and the remediation section specifically calls out blocking unauthorized access to the annunciator’s port 80/HTTP service. A vendor remediation plan is noted for future versions, but no fixed version is provided in the supplied corpus.

Defensive priority

High — prioritize if the devices are deployed on shared, routable, or otherwise observable networks, or if port 80/HTTP access cannot be tightly controlled.

Recommended defensive actions

• Place the remote annunciators in a protected network environment and keep them off the public internet and untrusted networks.
• Change any default passwords to reduce the risk of unauthorized access to device settings and information.
• Use network segmentation and firewall rules to block unauthorized access to the annunciator’s port 80/HTTP service.
• Review the Schneider Electric installation manuals and the vendor security notification page for deployment-specific guidance and updates.
• Subscribe to Schneider Electric security notifications so remediation updates can be tracked when they are published.

Evidence notes

The supplied CISA CSAF advisory and Schneider Electric notice both describe a CWE-319 cleartext transmission issue that can expose data when network traffic is sniffed. The advisory lists ASCO 5310 and ASCO 5350 as affected products and says the vendor is establishing a remediation plan for future versions. Until then, the documented mitigations are network protection, password changes, and blocking unauthorized HTTP access on port 80. The provided corpus does not list this CVE as KEV.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.