CVE-2025-2442 Schneider Electric CVE debrief

Who should care

OT/ICS asset owners, plant operators, maintenance teams, and field technicians responsible for Schneider Electric Trio™ Q Licensed Data Radio deployments, especially where devices may be physically reachable or handled during service.

Technical summary

The advisory identifies CWE-1188, initialization of a resource with an insecure default. The affected scope is Schneider Electric Trio™ Q Licensed Data Radio versions prior to 2.7.2. The published CVSS v3.1 vector is AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (6.8), reflecting that exploitation requires physical access but can lead to high impacts if the device is reset into its factory default mode. Vendor remediation is firmware 2.7.2, with verification guidance provided in the Trio Q Series Data Radio User Manual.

Defensive priority

Medium. The issue requires physical access, which lowers remote exposure, but the impact can be significant in operational environments if unauthorized local access is possible. Prioritize devices in shared, unattended, or field-deployed locations.

Recommended defensive actions

• Upgrade Trio™ Q Licensed Data Radio firmware to version 2.7.2 or later using the vendor-provided update package.
• Follow Section 10 Part J, Firmware Updating and Maintenance, in the Trio Q Series Data Radio User Manual to download, install, and verify the updated firmware.
• Verify firmware integrity using the hash published with the release notes before deployment.
• Restrict physical access to installed radios and place them in secure locations where practical.
• Securely dispose of radios when decommissioned to reduce the chance of unauthorized physical access.
• Use the vendor’s documented firmware update process and confirm the installed version after maintenance.

Evidence notes

The supplied CISA CSAF advisory (ICSA-25-107-01) and Schneider Electric references are both dated 2025-04-08, which is used here as the disclosure date. The affected product is listed as Schneider Electric Trio™ Q Licensed Data Radio version prior to 2.7.2. The vendor remediation explicitly names firmware v2.7.2 as the fix and provides update-verification guidance. No CISA KEV listing was included in the supplied data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.