Schneider Modicon PLCs CVE-2025-13901

Q: What is the CVSS score of CVE-2025-13901?

CVE-2025-13901 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Resource Shutdown or Release (CWE-404)

2026-03-10 cybersecurity@se.com

Denial Of Service Modicon M241 Firmware Modicon M251 Firmware Modicon M262 Firmware

6.9

CVSS 4.0 · Vendor: se

Severity by source

Vendor (se) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable with no auth or interaction; only low partial availability impact with no scope change, confidentiality, or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (se).

CVSS VectorVendor: se

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 23, 2026 - 15:53 NVD

6.9 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:17 nvd

N/A

DescriptionCVE.org

CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels.

AnalysisAI

Partial Denial of Service against Schneider Electric Modicon M241, M251, and M262 programmable logic controllers (PLCs) is achievable by unauthenticated remote attackers via the Machine Expert programming protocol. Exploitation requires only network reachability to the affected PLC - no credentials or user interaction - allowing an attacker to send malformed payloads that exhaust active communication channels through improper resource release (CWE-404). No public exploit code exists and EPSS is very low (0.05%), but the network-accessible attack surface with zero authentication in OT environments elevates operational risk beyond the Medium CVSS rating suggests.

Technical ContextAI

The affected products - Schneider Electric Modicon M241, M251, and M262 PLCs (CPE: cpe:2.3:o:schneider-electric:modicon_m24x_firmware) - are industrial programmable logic controllers used in factory automation and building management. Machine Expert is Schneider Electric's proprietary software suite and underlying communication protocol stack used for programming, configuration, and runtime monitoring of Modicon PLCs over Ethernet. The root cause is CWE-404 (Improper Resource Shutdown or Release): when the firmware receives a crafted or malformed payload on a Machine Expert protocol channel, it fails to properly release or close the allocated communication channel resources. Over repeated or sustained attempts, this resource exhaustion occupies active channel slots, degrading protocol availability. This class of vulnerability is particularly relevant in OT contexts where PLC communication continuity is safety- and process-critical.

RemediationAI

Consult Schneider Electric Security Notice SEVD-2026-069-01 (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-01) for vendor-confirmed patch guidance; a specific fixed firmware version is not independently confirmed in the available data beyond the advisory reference. As an immediate compensating control, network-segment Modicon PLCs so that the Machine Expert protocol port is accessible only from authorized engineering workstations - enforce this via industrial firewall or VLAN ACLs, not just logical policy. Disabling the Machine Expert programming interface entirely when not in active use (if the firmware supports this) eliminates the attack surface at the cost of remote programming capability. Where segmentation is not feasible, deploy an OT-aware network monitoring solution to detect abnormal or high-frequency connection attempts to Machine Expert ports as an early-warning indicator.