Schneider Modicon PLCs CVE-2025-13901

Network reachability to the Machine Expert protocol port on the affected Modicon PLC is the sole prerequisite - no authentication, no user interaction, and no special configuration is required (CVSS PR:N, UI:N, AC:L). The vulnerability is exercised via the Machine Expert engineering protocol itself, meaning any host that can reach the PLC's programming interface port (typically over Ethernet) can attempt exploitation. Exploitation is limited to a partial Denial of Service affecting only the PLC's communication availability (VA:L); full system compromise, confidentiality loss, or integrity modification are not in scope. Real-world exploitation is further constrained by the typical OT network segmentation that (when properly implemented) limits who can reach PLC Ethernet interfaces - environments without such segmentation are at elevated practical risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) scores 6.9 (Medium) and reflects a low-complexity, network-accessible, unauthenticated attack with only low availability impact and no confidentiality or integrity consequence. EPSS is 0.05% at the 16th percentile, indicating very low exploitation probability in the general threat landscape. No public exploit code and no CISA KEV listing have been identified, and exploitation status is no public exploit identified at time of analysis. However, the risk profile shifts materially in industrial contexts: PLCs like the Modicon M241/M251/M262 often lack authentication on engineering protocol ports by design (legacy OT assumptions), and even a partial DoS on the Machine Expert channel can disrupt engineering workstation connectivity, remote monitoring, or runtime parameter updates. The CVSS VA:L metric understates operational impact in environments where PLC communication continuity is process-critical. The low EPSS and absence of KEV suggest targeted rather than opportunistic exploitation is more likely, consistent with an ICS-specific threat actor.

An attacker with network access to the PLC's Machine Expert protocol port - achievable from a compromised engineering workstation or through a poorly segmented OT network - sends a sequence of crafted protocol payloads designed to open but not properly close communication channels. The firmware's failure to release these channel resources exhausts the available channel pool, causing the Machine Expert service to become partially unresponsive to legitimate engineering tool connections. No proof-of-concept code has been identified publicly, but the attack requires only basic protocol knowledge and low complexity.