IM
IronMonkey Threat Research
‹ Back to ICS Advisories

ASCO 5310 / 5350 Remote Annunciator

HIGH
CVSS 8.1
Date 2026-10-16T20:32:37+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 11-Feb-25 Document Reference Number – SEVD-2025 -042-01 Page 1 of 4 # ASCO 5310 / 5350 Remote Annunciator 11 February 2025 ## Overview Schneider Electric is aware of multiple vulnerabilities in its ASCO 5310 Remote Annunciator and ASCO 5350 Remote Annunciator products. The ASCO 5310 Remote Annunciator and ASCO 5350 Remote Annunciator products are stand-alone, industrial grade interface devices providing transfer switch status indication and transfer/retransfer control. Failure to apply the mitigations provided below may risk a Denial of Service, loss of availability, or loss of device integrity, which could result in the inability to use the Remote Annunciator to monitor transfer switch status and/or perform transfer/retransfer operations. The base operation of the transfer switch itself is not impacted. ## Affected Products and Versions Product Version ASCO 5310 Single-Channel Remote Annunciator All Versions ASCO 5350 Eight Channel Remote Annunciator All Versions ## Vulnerability Details CVE ID: CVE-2025-1058 CVSS v3.1 Base Score 8.1 | High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS v4.0 Base Score 7.2 | High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is downloaded. CVE ID: CVE-2025-1059 CVSS v3.1 Base Score 7.5 | High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS v4.0 Base Score 8.7 | High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious packets are sent to the webserver of the device. CVE ID: CVE-2025-1060

// Vulnerabilities (4)

CVE ID CVSS Score Severity Description
CVE-2025-1060 8.1 high
CVE-2025-1060. CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network traffic is being sniffed by an attacker.
CVE-2025-1059 8.1 high
CVE-2025-1059. CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious packets are sent to the webserver of the device.
CVE-2025-1058 8.1 high
CVE-2025-1058. CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is downloaded.
CVE-2025-1070 8.1 high
CVE-2025-1070. CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file is downloaded.

// Remediations (1)

Mitigation: Schneider Electric is establishing a remediation plan for all future versions of ASCO 5310 Single-C
Schneider Electric is establishing a remediation plan for all future versions of ASCO 5310 Single-Channel Remote Annunciator and ASCO 5350 Eight Channel Remote Annunciator that may include a fix for these vulnerabilities. We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit: • Use remote annunciator devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. • Change default password to help prevent unauthorized access to device settings and information. • Setup network segmentation and implement a firewall to block all unauthorized access to the annunciator port 80/HTTP. • For more details on the ASCO 5310 refer to “Installation Manual | ASCO 5310 ATS Remote Annunciator” which can be found here: https://www.se.com/ww/en/product-range/66129-asco-5310-singlechannelremote-annunciator/-documents • For more details on the ASCO 5350 refer to “Installation Manual | ASCO 5350 ATS Remote Annunciator” which can be found here: https://www.se.com/ww/en/product-range/66130-asco-5350-eight-channelremote-annunciator/-documents To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here: https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

// References