Summary
Schneider Electric is aware of multiple vulnerabilities in its ASCO 5310 Remote Annunciator and ASCO 5350
Remote Annunciator products.
The ASCO 5310 Remote Annunciator and ASCO 5350 Remote Annunciator products are stand-alone,
industrial grade interface devices providing transfer switch status indication and transfer/retransfer control.
Failure to apply the mitigations provided below may risk a Denial of Service, loss of availability, or loss of
device integrity, which could result in the inability to use the Remote Annunciator to monitor transfer switch
status and/or perform transfer/retransfer operations. The base operation of the transfer switch itself is not
impacted.
Vulnerabilities 4
-
High 8.1
CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when mal…
-
High 8.1
CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable w…
-
High 7.5
CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to s…
-
High 7.5
CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data…
Revision history
-
#1.0.0
Original Release
References
-
ASCO 5310 / 5350 Remote Annunciator - SEVD-2025-042-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-042-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2025-042-01.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390
-
ICS Advisory ICSA-25-077-05 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-077-05
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B