CVE-2025-3899
mediumPriorität · verfolgen · 0EPSS 0.002 · 6. PerzentilEUUSEPSS · bewertet 2026-10-28
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in Certificates page on Webserver that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenModicon Controllers M241cisa_csaf_ot
Version 5.3.12.51 of Modicon Controllers M241 includes a fix for these vulnerabilities and can be downloaded here: M241:https://www.se.com/ww/en/product-range/62129-modicon-m241-micro-plc/#software-and-firmware •Use the Controller Assistant feature of EcoStruxure™ Automation Expert – Motion v24.1 or EcoStruxure™ Machine Expert v2.3 to update the M241 firmware and perform a reboot. •EcoStruxure™ Automation Expert – Motion V24.1 is available via the Schneider Electric Software Installer: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER. • Additional information is available in the Quick Start Guide, chapter “EcoStruxure™ Automation Expert Platform Installation”.
https://www.se.com/ww/en/product-range/62129-modicon-m241-micro-plc/#software-and-firmware - BehobenModicon Controllers M251cisa_csaf_ot
Version 5.3.12.51 of Modicon Controllers M251 includes a fix for these vulnerabilities and can be downloaded here: M251:https://www.se.com/ww/en/product-range/62130-modicon-m251-micro-plc-with-dual-channel-comm/#software-and-firmware •Use the Controller Assistant feature of EcoStruxure™ Automation Expert – Motion v24.1 or EcoStruxure™ Machine Expert v2.3 to update the M251 firmware and perform a reboot. •EcoStruxure™ Automation Expert – Motion V24.1 is available via the Schneider Electric Software Installer: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER. • Additional information is available in the Quick Start Guide, chapter “EcoStruxure™ Automation Expert Platform Installation”.
https://www.se.com/ww/en/product-range/62130-modicon-m251-micro-plc-with-dual-channel-comm/#software-and-firmware - MitigationModicon Controllers M241cisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: * Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. * Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. * Deactivate the Webserver after use when not needed. * Use encrypted communication links. * Setup network segmentation and implement a firewall to block all unauthorized access to ports 80/HTTP and 443/HTTPS. * Use VPN (Virtual Private Networks) tunnels if remote access is required. * The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 provide product specific hardening guidelines.
https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 - MitigationModicon Controllers M251cisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: * Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. * Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. * Deactivate the Webserver after use when not needed. * Use encrypted communication links. * Setup network segmentation and implement a firewall to block all unauthorized access to ports 80/HTTP and 443/HTTPS. * Use VPN (Virtual Private Networks) tunnels if remote access is required. * The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 provide product specific hardening guidelines.
https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 1.2–5.4
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (7)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-25-175-03Schneider Electric Modicon Controllers (Update A)2025-06-10icsa · cisa_csaf_otUS
Schneider Electric is aware of multiple vulnerabilities in its Modicon Controllers M241 / M251 / M258 / LMC058 / M262 products. The Modicon Controllers M241/M251/M258/M262 https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/ and Modicon LMC058 https://www.se.com/ww/en/product-range/7744-modicon-lmc058/ products are Programmable Logic Controllers for performance-demanding applications. Failure to apply remediation/mitigations provided below may risk Cross-Site Scripting, Denial of Service or uncontrolled resource consumption which could result in loss of confidentiality, integrity and availability of the controller.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (5)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2025-3899cnnvd
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-161-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-161-02.pdfcnnvd
- https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jspPatchcnnvd
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-161-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-161-02.pdfenisa_euvd
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-161-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-161-02.pdfnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan