CVE-2025-3117
mediumpriority · track · 0EPSS 0.002 · 13 %ileEUUSEPSS · scored 2026-10-23
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting configuration file paths that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedModicon Controllers M241cisa_csaf_ot
Version 5.3.12.51 of Modicon Controllers M241 includes a fix for these vulnerabilities and can be downloaded here: M241:https://www.se.com/ww/en/product-range/62129-modicon-m241-micro-plc/#software-and-firmware •Use the Controller Assistant feature of EcoStruxure™ Automation Expert – Motion v24.1 or EcoStruxure™ Machine Expert v2.3 to update the M241 firmware and perform a reboot. •EcoStruxure™ Automation Expert – Motion V24.1 is available via the Schneider Electric Software Installer: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER. • Additional information is available in the Quick Start Guide, chapter “EcoStruxure™ Automation Expert Platform Installation”.
https://www.se.com/ww/en/product-range/62129-modicon-m241-micro-plc/#software-and-firmware - FixedModicon Controllers M251cisa_csaf_ot
Version 5.3.12.51 of Modicon Controllers M251 includes a fix for these vulnerabilities and can be downloaded here: M251:https://www.se.com/ww/en/product-range/62130-modicon-m251-micro-plc-with-dual-channel-comm/#software-and-firmware •Use the Controller Assistant feature of EcoStruxure™ Automation Expert – Motion v24.1 or EcoStruxure™ Machine Expert v2.3 to update the M251 firmware and perform a reboot. •EcoStruxure™ Automation Expert – Motion V24.1 is available via the Schneider Electric Software Installer: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER. • Additional information is available in the Quick Start Guide, chapter “EcoStruxure™ Automation Expert Platform Installation”.
https://www.se.com/ww/en/product-range/62130-modicon-m251-micro-plc-with-dual-channel-comm/#software-and-firmware - FixedModicon Controllers M262cisa_csaf_ot
Versions from 5.3.9.18 of Modicon Controllers M262 include a fix for these vulnerabilities and can be downloaded here: https://www.se.com/ww/en/product-range/65771-logic-motion-controllermodicon-m262/#software-and-firmware •Use the Controller Assistant feature of EcoStruxure™ Automation Expert – Motion v24.1or EcoStruxure™ Machine Expert v2.3 to update the M262 firmware and perform a reboot. •EcoStruxure™ Automation Expert – Motion V24.1 is available via the Schneider Electric Software Installer: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER. • Additional information is available in the Quick Start Guide, chapter “EcoStruxure™ Automation Expert Platform Installation”.
https://www.se.com/ww/en/product-range/65771-logic-motion-controller-modicon-m262/#software-and-firmware - MitigationModicon Controllers LMC058cisa_csaf_ot
Schneider Electric is establishing a remediation plan for all future versions of Modicon M258/LMC058 that will include a fix for this vulnerability. We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit: * Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. * Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. * Deactivate the Webserver after use when not needed. * Use encrypted communication links. * Setup network segmentation and implement a firewall to block all unauthorized access to ports 80/HTTP and 443/HTTPS. * Use VPN (Virtual Private Networks) tunnels if remote access is required. * The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 provide product specific hardening guidelines.
https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 - MitigationModicon Controllers M241cisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: * Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. * Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. * Deactivate the Webserver after use when not needed. * Use encrypted communication links. * Setup network segmentation and implement a firewall to block all unauthorized access to ports 80/HTTP and 443/HTTPS. * Use VPN (Virtual Private Networks) tunnels if remote access is required. * The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 provide product specific hardening guidelines.
https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 - MitigationModicon Controllers M251cisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: * Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. * Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. * Deactivate the Webserver after use when not needed. * Use encrypted communication links. * Setup network segmentation and implement a firewall to block all unauthorized access to ports 80/HTTP and 443/HTTPS. * Use VPN (Virtual Private Networks) tunnels if remote access is required. * The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 provide product specific hardening guidelines.
https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 - MitigationModicon Controllers M258cisa_csaf_ot
Schneider Electric is establishing a remediation plan for all future versions of Modicon M258/LMC058 that will include a fix for this vulnerability. We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit: * Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. * Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. * Deactivate the Webserver after use when not needed. * Use encrypted communication links. * Setup network segmentation and implement a firewall to block all unauthorized access to ports 80/HTTP and 443/HTTPS. * Use VPN (Virtual Private Networks) tunnels if remote access is required. * The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 provide product specific hardening guidelines.
https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 - MitigationModicon Controllers M262cisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: * Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. * Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. * Deactivate the Webserver after use when not needed. * Use encrypted communication links. * Setup network segmentation and implement a firewall to block all unauthorized access to ports 80/HTTP and 443/HTTPS. * Use VPN (Virtual Private Networks) tunnels if remote access is required. * The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242 provide product specific hardening guidelines.
https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.2–5.4
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (15)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-25-175-03Schneider Electric Modicon Controllers (Update A)2025-06-10icsa · cisa_csaf_otUS
Schneider Electric is aware of multiple vulnerabilities in its Modicon Controllers M241 / M251 / M258 / LMC058 / M262 products. The Modicon Controllers M241/M251/M258/M262 https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/ and Modicon LMC058 https://www.se.com/ww/en/product-range/7744-modicon-lmc058/ products are Programmable Logic Controllers for performance-demanding applications. Failure to apply remediation/mitigations provided below may risk Cross-Site Scripting, Denial of Service or uncontrolled resource consumption which could result in loss of confidentiality, integrity and availability of the controller.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-161-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-161-02.pdfcnnvd
- https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jspPatchcnnvd
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-161-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-161-02.pdfenisa_euvd
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-161-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-161-02.pdfnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan