CVE-2025-2875
highpriority · track · 0EPSS 0.004 · 37 %ileEURUUSEPSS · scored 2026-10-23
CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker manipulates controller’s webserver URL to access resources.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedModicon Controllers LMC058cisa_csaf_ot
Modicon M258/LMC058 Firmware version 5.0.4.19 includes a fix for this vulnerability and can be downloaded here: https://www.se.com/ww/en/product-range/2730-modicon-m258-compact-plc-for-machine-automation/#software-and-firmware By using Controller Assistant from EcoStruxureTM Machine Expert update Modicon Controller M258/LMC058 and perform reboot.
https://www.se.com/ww/en/product-range/2730-modicon-m258-compact-plc-for-machine-automation/#software-and-firmware - FixedModicon Controllers M241cisa_csaf_ot
Versions 5.3.12.48 of Modicon Controllers M241 include a fix for this vulnerability and can be downloaded here: M241:https://www.se.com/ww/en/product-range/62129-modicon-m241-micro-plc/#software-and-firmware * Use the Controller Assistant feature of EcoStruxure™ Automation Expert - Motion V24.1 or EcoStruxure™ Machine Expert V2.3 to update the M241/M251 firmware and perform a reboot. * EcoStruxure™ Automation Expert - Motion V24.1 and EcoStruxure™ Machine Expert V2.3 are available via the Schneider Electric Software Installer: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER * Additional information is available in the Quick Start Guide, chapter “EcoStruxure™ Automation Expert Platform Installation”.
https://www.se.com/ww/en/product-range/62129-modicon-m241-micro-plc/#software-and-firmware - FixedModicon Controllers M251cisa_csaf_ot
Versions 5.3.12.48 of Modicon Controllers M251 include a fix for this vulnerability and can be downloaded here: M251:https://www.se.com/ww/en/product-range/62130-modicon-m251-micro-plc-with-dual-channel-comm/#software-and-firmware * Use the Controller Assistant feature of EcoStruxure™ Automation Expert - Motion V24.1 or EcoStruxure™ Machine Expert V2.3 to update the M241/M251 firmware and perform a reboot. * EcoStruxure™ Automation Expert - Motion V24.1 and EcoStruxure™ Machine Expert V2.3 are available via the Schneider Electric Software Installer: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER * Additional information is available in the Quick Start Guide, chapter “EcoStruxure™ Automation Expert Platform Installation”.
https://www.se.com/ww/en/product-range/62130-modicon-m251-micro-plc-with-dual-channel-comm/#software-and-firmware - FixedModicon Controllers M258cisa_csaf_ot
Modicon M258/LMC058 Firmware version 5.0.4.19 includes a fix for this vulnerability and can be downloaded here: https://www.se.com/ww/en/product-range/2730-modicon-m258-compact-plc-for-machine-automation/#software-and-firmware By using Controller Assistant from EcoStruxureTM Machine Expert update Modicon Controller M258/LMC058 and perform reboot.
https://www.se.com/ww/en/product-range/2730-modicon-m258-compact-plc-for-machine-automation/#software-and-firmware - MitigationModicon Controllers LMC058cisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Deactivate the Webserver after use when not needed. • Use encrypted communication links when available. • Setup network segmentation and implement a firewall to block all unauthorized access to ports 80/HTTP and 443/HTTPS. • Use VPN (Virtual Private Networks) tunnels if remote access is required. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide product specific hardening guidelines. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp
https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 - MitigationModicon Controllers M241cisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Deactivate the Webserver after use when not needed. • Use encrypted communication links when available. • Setup network segmentation and implement a firewall to block all unauthorized access to ports 80/HTTP and 443/HTTPS. • Use VPN (Virtual Private Networks) tunnels if remote access is required. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide product specific hardening guidelines. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp
https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 - MitigationModicon Controllers M251cisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Deactivate the Webserver after use when not needed. • Use encrypted communication links when available. • Setup network segmentation and implement a firewall to block all unauthorized access to ports 80/HTTP and 443/HTTPS. • Use VPN (Virtual Private Networks) tunnels if remote access is required. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide product specific hardening guidelines. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp
https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 - MitigationModicon Controllers M258cisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Deactivate the Webserver after use when not needed. • Use encrypted communication links when available. • Setup network segmentation and implement a firewall to block all unauthorized access to ports 80/HTTP and 443/HTTPS. • Use VPN (Virtual Private Networks) tunnels if remote access is required. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide product specific hardening guidelines. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp
https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–8.7
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (22)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-25-140-08Schneider Electric Modicon Controllers (Update B)2025-05-13icsa · cisa_csaf_otUS
Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251 / M258 / LMC058 products. The Modicon Controllers M241/M251/M258 https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/ and Modicon LMC058 https://www.se.com/ww/en/product-range/7744-modicon-lmc058/ products are Programmable Logic Controllers for performance-demanding applications. Failure to apply remediation/mitigations provided below may risk an unauthenticated read of arbitrary files which could result in loss of confidential data stored on the controller. July 2025 Update: A remediation is now available within EcoStruxure™ Machine Expert v2.3 used to update the Modicon Controlers firmware.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-133-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-133-01.pdfcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2025-2875cnnvd
- https://www.se.com/us/en/product-range/2226-ecostruxure-machine-expert-software/#software-and-firmwarePatchcnnvd
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-133-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-133-01.pdfenisa_euvd
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-133-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-133-01.pdfnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan