CVE-2025-13902 MEDIUM

Published: 2026-03-10 | Last Modified: 2026-06-23 | Status: Analyzed

Description

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload.

Additional Descriptions (1)

Existe una vulnerabilidad CWE-79 de Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web ('cross-site scripting') que podría causar una condición en la que atacantes autenticados pueden hacer que el navegador de una víctima ejecute JavaScript arbitrario cuando la víctima pasa el cursor sobre un elemento creado maliciosamente en un servidor web que contiene la carga útil inyectada.

CVSS Metrics

Base Score: 5.4 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	LOW
User Interaction	REQUIRED
Scope	CHANGED
Confidentiality Impact	LOW
Integrity Impact	LOW
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 2.3

Impact Score: 2.7

Base Score: 5.1 (MEDIUM)

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector	NETWORK
Attack Complexity	LOW
Attack Requirements	NONE
Privileges Required	LOW
User Interaction	PASSIVE
Vulnerability Confidentiality	NONE
Vulnerability Integrity	NONE
Vulnerability Availability	NONE
Subsequent Confidentiality	LOW
Subsequent Integrity	LOW
Subsequent Availability	NONE

Source: [email protected]

Type: Secondary

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-79

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	modicon_m258_firmware	-	<built-in method update of dict object at 0x7e613c4c1e00>	Operating System
schneider-electric	modicon_lmc058_firmware	-	<built-in method update of dict object at 0x7e60bb8851c0>	Operating System
schneider-electric	modicon_m251_firmware	*	<built-in method update of dict object at 0x7e60a8a54180>	Operating System
schneider-electric	modicon_m241_firmware	*	<built-in method update of dict object at 0x7e6112306ac0>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m258_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m258:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_lmc058_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_lmc058:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m251_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m251:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m241_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m241:-:::::::*`

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-02.pdf
Source: [email protected]

Vendor Advisory Mitigation Patch