CVE-2024-6528

mediumpriority · track · 24EPSS 0.003 · 17 %ileEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.26% (17th) EPSS
CVSS 6.1 · medium
Is it mine?
21 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-23

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulnerability leading to a cross-site scripting condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a page containing the injected payload.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedSchneider Electric Modicon Controllers M258 / LMC058cisa_csaf_ot

    Schneider Electric Modicon Controllers Version prior to v5.2.11.24, Schneider Electric Modicon Controllers M258 / LMC058 All versions , Schneider Electric Modicon Controllers M262 Versions prior to v5.2.8.26, Schneider Electric Modicon Controllers Version prior to v5.2.11.24: Modicon Controller M262 Firmware version 5.2.8.26 delivered with EcoStruxure Machine Expert v2.2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machineexpert-software/ On the engineering workstation, update to v2.2.2 of EcoStruxure Machine Expert. By using Controller Assistant from EcoStruxureTM Machine Expert update Modicon Controller M258/LMC058 and perform reboot .

    https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/
  • FixedSchneider Electric Modicon Controllers M262cisa_csaf_ot

    Schneider Electric Modicon Controllers M262 Versions prior to v5.2.8.26: Modicon Controller M262 Firmware version 5.2.8.26 delivered with EcoStruxure Machine Expert v2.2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2.2 of EcoStruxure Machine Expert. Update Modicon Controller M262 to the latest Firmware and perform reboot

    https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/
  • MitigationSchneider Electric Modicon Controllers M241cisa_csaf_ot

    If users choose not to apply the remediation provided above they should immediately apply the following mitigations to reduce the risk of exploit:

  • MitigationSchneider Electric Modicon Controllers M251cisa_csaf_ot

    If users choose not to apply the remediation provided above they should immediately apply the following mitigations to reduce the risk of exploit:

  • MitigationSchneider Electric Modicon Controllers M258 / LMC058cisa_csaf_ot

    If users choose not to apply the remediation provided above they should immediately apply the following mitigations to reduce the risk of exploit:

  • MitigationSchneider Electric Modicon Controllers M262cisa_csaf_ot

    If users choose not to apply the remediation provided above they should immediately apply the following mitigations to reduce the risk of exploit:

02

cvss

Technical severity, 0–10. One row per scoring source.

6.1
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.7
v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nsecondary · CISA US
v3.15.4mediumAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU
v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nsecondary · ENISA EU
v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nsecondary · cybersecurity@se.comexploitability 2.3 · impact 2.7
v3.15.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-707USCWE-74USCWE-79USCWE-79USCWE-79US
05

affected products (21)

Products and version ranges known to be affected.

showing 20 of 21
06

advisories (1)

Vendor and ecosystem advisories describing this.

  • ICSA-24-354-07Schneider Electric Modicon Controllers (Update A)2024-12-19icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could allow an attacker to cause a victim's browser to run arbitrary JavaScript when visiting a page containing injected payload.

07

also known as (4)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducisa_csaf_otnvdNVDCVE.orgMITRE
published 2024-07-11modified 2026-06-17
09

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan