CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file is downloaded.

CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file is downloaded.

Schneider Electric is aware of multiple vulnerabilities in its ASCO 5310 Remote Annunciator and ASCO 5350 Remote Annunciator products. The ASCO 5310 Remote Annunciator and ASCO 5350 Remote Annunciator products are stand-alone, industrial grade interface devices providing transfer switch status indication and transfer/retransfer control. Failure to apply the mitigations provided below may risk a Denial of Service, loss of availability, or loss of device integrity, which could result in the inability to use the Remote Annunciator to monitor transfer switch status and/or perform transfer/retransfer operations. The base operation of the transfer switch itself is not impacted.

Schneider Electric is aware of multiple vulnerabilities in its ASCO 5310 Remote Annunciator and ASCO 5350 Remote Annunciator products. The ASCO 5310 Remote Annunciator and ASCO 5350 Remote Annunciator products are stand-alone, industrial grade interface devices providing transfer switch status indication and transfer/retransfer control. Failure to apply the mitigations provided below may risk a Denial of Service, loss of availability, or loss of device integrity, which could result in the inability to use the Remote Annunciator to monitor transfer switch status and/or perform transfer/retransfer operations. The base operation of the transfer switch itself is not impacted.