CVE-2025-13901

mediumEPSS 0.005 · 39 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.47% (39th) EPSS

CVSS 5.3 · medium

Is it mine?

14 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-18

CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels.

cvss

Technical severity, 0–10. One row per scoring source.

6.9

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lprimary · NVD / NIST USexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · CISA US

v3.15.3mediumAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · FSTEC (BDU) RU

v4.06.9mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.06.9mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · cybersecurity@se.com

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-404USCWE-404USCWE-404US

affected products (14)

Products and version ranges known to be affected.

Modicon M241 Firmware Version 5.4.13.12 installed on Modicon Controller M241all versionsfixedcisa_csaf_otUS
Modicon M241 Firmware versions prior to 5.4.13.12 installed on Modicon Controller M241all versionscisa_csaf_otUS
Modicon M251 Firmware Version 5.4.13.12 installed on Modicon Controller M251all versionsfixedcisa_csaf_otUS
Modicon M251 Firmware versions prior to 5.4.13.12 installed on Modicon Controller M251all versionscisa_csaf_otUS
Modicon M262 Firmware Version 5.4.10.12 installed on Modicon Controller M262all versionsfixedcisa_csaf_otUS
Modicon M262 Firmware versions prior to 5.4.10.12 installed on Modicon Controller M262all versionscisa_csaf_otUS
Schneider Electric Modicon M241/M251≤ Versions prior to 5.4.13.12enisa_euvdEU
Schneider Electric Modicon M262≤ Versions prior to 5.4.10.12enisa_euvdEU
Schneider Electric Modicon M241≤ 5.4.13.12fstec_bduRU
Schneider Electric Modicon M251≤ 5.4.13.12fstec_bduRU
Schneider Electric Modicon M262≤ 5.4.10.12fstec_bduRU
schneider-electric modicon m241 firmware< 5.4.13.12nvdUScpe:2.3:o:schneider-electric:modicon_m241_firmware:*:*:*:*:*:*:*:*
schneider-electric modicon m251 firmware< 5.4.13.12nvdUScpe:2.3:o:schneider-electric:modicon_m251_firmware:*:*:*:*:*:*:*:*
schneider-electric modicon m262 firmware< 5.4.10.12nvdUScpe:2.3:o:schneider-electric:modicon_m262_firmware:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

ICSA-26-078-01Schneider Electric Modicon M241, M251, and M2622026-03-10icsa · cisa_csaf_otUS
Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251, and M262 products. The Modicon Controllers M241 / M251 / M262 are Programmable Logic Controllers for performancedemanding applications. Failure to apply the remediation provided below may risk Denial of Service attack which could result in loss of availability of the controller

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd NVD CVE.org MITRE

published 2026-03-10modified 2026-06-23

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan