IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2025-161-02 — Modicon Controllers M241/M251/M258/LMC058/M262

MEDIUM
CVSS 6.5
Date 2026-10-16T20:31:46+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 10-Jun-25 (08-Jul-25) Document Reference Number – SEVD-2025-161-02 (v2.0.0) Page 1 of 7 Public / TLP: Clear > Public ## Modicon Controllers M241/M251/M258/LMC058/M262 10 June 2025 (8 July 2025) ## Overview Schneider Electric is aware of multiple vulnerabilities in its Modicon Controllers M241/M251/M258/LMC058/ M262 products. The Modicon Controllers M241/M251/M258/M262 and Modicon LMC058 products are Programmable Logic Controllers for performance-demanding applications. Failure to apply remediation/mitigations provided below may risk Cross-Site Scripting, Denial of Service or uncontrolled resource consumption which could result in loss of confidentiality, integrity and availability of the controller. July 2025 Update: A remediation is now available within EcoStruxure™ Machine Expert v2.3 used to update the Modicon Controllers firmware. ## Affected Products and Versions Product CVE-2025-3898 CVE-2025-3899 CVE-2025-3112 CVE-2025-3905 CVE-2025-3116 CVE-2025-3117 Modicon Controllers M241/M251 Versions prior to 5.3.12.51 Versions prior to 5.3.12.51 Versions prior to 5.3.12.51 Versions prior to 5.3.12.51 Modicon Controllers M262 Versions prior to 5.3.9.18 Not impacted Not impacted Versions prior to 5.3.9.18 Modicon Controllers M258/LMC058 Not impacted Not impacted All versions All versions ## Vulnerability Details CVE ID: CVE-2025-3898 CVSS v3.1 Base Score 6.5 | Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS v4.0 Base Score 7.1 | High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends HTTPS request containing invalid data type to the webserver. CVE ID: CVE-2025-3899 CVSS v3.1 Base Score 5.4 | Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

// Vulnerabilities (6)

CVE ID CVSS Score Severity Description
CVE-2025-3112 6.5 medium
CVE-2025-3112. CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause Denial of Service when an authenticated malicious user sends manipulated HTTPS Content-Length header to the webserver.
CVE-2025-3905 6.5 medium
CVE-2025-3905. CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting PLC system variables that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser.
CVE-2025-3898 6.5 medium
CVE-2025-3898. CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends HTTPS request containing invalid data type to the webserver.
CVE-2025-3117 6.5 medium
CVE-2025-3117. CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting configuration file paths that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser.
CVE-2025-3116 6.5 medium
CVE-2025-3116. CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends special malformed HTTPS request containing improper formatted body data to the controller.
CVE-2025-3899 6.5 medium
CVE-2025-3899. CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in Certificates page on Webserver that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser.

// Affected Products (5)

Vendor Product Asset Type Purdue Level Firmware
Schneider Electric Schneider Electric Modicon Controllers M251 plc
L1
--
Schneider Electric Schneider Electric Modicon Controllers M241 plc
L1
--
Schneider Electric Schneider Electric Modicon Controllers LMC058 plc
L1
--
Schneider Electric Schneider Electric Modicon Controllers M258 plc
L1
--
Schneider Electric Schneider Electric Modicon Controllers M262 plc
L1
--

// Remediations (5)

Patch: Versions from 5.3.9.18 of Modicon Controllers M262 include a fix for these vulnerabilities and can
Versions from 5.3.9.18 of Modicon Controllers M262 include a fix for these vulnerabilities and can be downloaded here: https://www.se.com/ww/en/product-range/65771-logic-motion-controllermodicon-m262/#software-and-firmware •Use the Controller Assistant feature of EcoStruxure™ Automation Expert – Motion v24.1or EcoStruxure™ Machine Expert v2.3 to update the M262 firmware and perform a reboot. •EcoStruxure™ Automation Expert – Motion V24.1 is available via the Schneider Electric Software Installer: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER. • Additional information is available in the Quick Start Guide, chapter “EcoStruxure™ Automation Expert Platform Installation”.
Patch: Version 5.3.12.51 of Modicon Controllers M241 includes a fix for these vulnerabilities and can be
Version 5.3.12.51 of Modicon Controllers M241 includes a fix for these vulnerabilities and can be downloaded here: M241:https://www.se.com/ww/en/product-range/62129-modicon-m241-micro-plc/#software-and-firmware •Use the Controller Assistant feature of EcoStruxure™ Automation Expert – Motion v24.1 or EcoStruxure™ Machine Expert v2.3 to update the M241 firmware and perform a reboot. •EcoStruxure™ Automation Expert – Motion V24.1 is available via the Schneider Electric Software Installer: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER. • Additional information is available in the Quick Start Guide, chapter “EcoStruxure™ Automation Expert Platform Installation”.
Patch: Version 5.3.12.51 of Modicon Controllers M251 includes a fix for these vulnerabilities and can be
Version 5.3.12.51 of Modicon Controllers M251 includes a fix for these vulnerabilities and can be downloaded here: M251:https://www.se.com/ww/en/product-range/62130-modicon-m251-micro-plc-with-dual-channel-comm/#software-and-firmware •Use the Controller Assistant feature of EcoStruxure™ Automation Expert – Motion v24.1 or EcoStruxure™ Machine Expert v2.3 to update the M251 firmware and perform a reboot. •EcoStruxure™ Automation Expert – Motion V24.1 is available via the Schneider Electric Software Installer: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER. • Additional information is available in the Quick Start Guide, chapter “EcoStruxure™ Automation Expert Platform Installation”.
Mitigation: If customers choose not to apply the remediation provided above, they should immediately apply the f
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: * Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. * Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. * Deactivate the Webserver after use when not needed. * Use encrypted communication links. * Setup network segmentation and implement a firewall to block all unauthorized access to ports 80/HTTP and 443/HTTPS. * Use VPN (Virtual Private Networks) tunnels if remote access is required. * The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 provide product specific hardening guidelines.
Mitigation: Schneider Electric is establishing a remediation plan for all future versions of Modicon M258/LMC0
Schneider Electric is establishing a remediation plan for all future versions of Modicon M258/LMC058 that will include a fix for this vulnerability. We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit: * Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. * Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. * Deactivate the Webserver after use when not needed. * Use encrypted communication links. * Setup network segmentation and implement a firewall to block all unauthorized access to ports 80/HTTP and 443/HTTPS. * Use VPN (Virtual Private Networks) tunnels if remote access is required. * The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 provide product specific hardening guidelines.

// References