IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2025-098-02 — Trio™ Q Licensed Data Radios

MEDIUM
CVSS 6.8
Date 2026-10-16T20:32:18+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification > 08-Apr-25 Document Reference Number – SEVD-2025-098-02 Page 1 of 5 > Public ## Trio™ Q Licensed Data Radios 8 April 2025 Overview Schneider Electric is aware of a vulnerability in its Trio ™ Q Licensed Data Radio product. The Trio Q Licensed Data Radios product is an advanced, high-speed licensed digital data radios, providing both Ethernet and serial communications for complex and demanding applications in Point-to-Point Multipoint (Multiple Address Radio) Telemetry and remote SCADA Systems. Failure to apply the remediations or mitigations provided below may risk disclosure of information that could result in unauthorized access, loss of confidentiality, integrity, and availability of the product. Affected Products and Versions Product Version Trio ™ Q Licensed Data Radio Versions prior to v2.7.2 Vulnerability Details CVE ID: CVE-2025-2440 CVSS v3.1 Base Score 4.2 | Medium | CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS v4.0 Base Score 4.1 | Medium | CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential data when a malicious user, having physical access and advanced information on the file system, sets the radio in factory default mode. CVE ID: CVE-2025-2441 CVSS v3.1 Base Score 4.6 | Medium | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS v4.0 Base Score 4.1 | Medium | CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of confidentiality when a malicious user, having physical access, sets the radio in factory default mode where the product does not correctly initialize all data. Schneider Electric Security Notification > 08-Apr-25 Document Reference Number – SEVD-2025-098-02 Page 2 of 5 > Public

// Vulnerabilities (3)

CVE ID CVSS Score Severity Description
CVE-2025-2442 6.8 high
CVE-2025-2442. CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access which could result in the loss of confidentially, integrity and availability when a malicious user, having physical access, sets the radio to the factory default mode.
CVE-2025-2441 6.8 high
CVE-2025-2441. CWE-1188: Incorrect Initialization of Resource vulnerability exists that could lead to loss of confidentiality when a malicious user, having physical access, sets the radio in factory default mode where the product does not correctly initialize all data.
CVE-2025-2440 6.8 high
CVE-2025-2440. CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential data when a malicious user, having physical access and advanced information on the file system, sets the radio in factory default mode.

// Remediations (2)

Mitigation: If customers choose not to apply the remediation provided above, they should immediately apply the f
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Trio™ Data Radios should be installed in a secure location to prevent physical access by unauthorized personnel and securely disposed when decommissioned. • Firmware loaded in Trio™ Data Radios should be confirmed using the hash published with the release notes and following the instructions in Section 10 Part J – Firmware Updating and Maintenance in the Trio Q Series Data Radio User Manual This section provides information on how to download, install, and verify the new firmware version.
Patch: Version v2.7.2 of the TRIO™ Q Data Radio firmware includes fixes for the identified vulnerabilitie
Version v2.7.2 of the TRIO™ Q Data Radio firmware includes fixes for the identified vulnerabilities and is available for download here: https://www.se.com/ww/en/product-range/61419-trio-licensed-radios/#software-andfirmware Instructions should be followed from Section 10 Part J – Firmware Updating and Maintenance in the Trio Q Series Data Radio User Manual This section provides information on how to download, install, and verify the new firmware version.

// References