Modicon PLC Firmware CVE-2025-13902
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible web interface with low-privilege auth and required hover interaction; scope changes to victim browser with limited credential/session confidentiality and integrity impact.
Primary rating from Vendor (se).
CVSS VectorVendor: se
Lifecycle Timeline
3DescriptionCVE.org
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload.
AnalysisAI
Cross-site scripting in Schneider Electric Modicon PLC embedded web servers (M258, LMC058, M251, M241) allows authenticated low-privilege attackers to inject persistent JavaScript payloads that execute in a victim engineer's browser upon hovering over a crafted element. In industrial OT environments, successful exploitation could compromise engineering workstation sessions, steal credentials used to configure programmable logic controllers, or manipulate displayed process data. No public exploit code exists and the CVE is absent from CISA KEV; EPSS at 0.05% (14th percentile) confirms low current exploitation likelihood, though the ICS context elevates operational consequence beyond what raw scores suggest.
Technical ContextAI
The vulnerability resides in the embedded HTTP web server exposed by Schneider Electric Modicon series PLCs - specifically M241, M251, M258, and LMC058 motion controllers. These devices run firmware that hosts a web interface used by engineers for configuration, diagnostics, and monitoring of industrial automation processes. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the firmware fails to sanitize or encode attacker-controlled input before rendering it in HTML responses, enabling script injection. The hover-triggered execution mechanism (UI:P in CVSS 4.0 passive interaction) points to an onmouseover or CSS hover-event handler abuse pattern, meaning the payload fires without an explicit click. CPE strings confirm all firmware revisions are potentially affected for M241 and M251 (wildcard version field), while M258 and LMC058 CPEs list a dash for the version, suggesting all known versions are in scope.
RemediationAI
Consult Schneider Electric security advisory SEVD-2026-069-02 for official firmware update guidance - no exact patched firmware version number is confirmed in available data and should be obtained directly from the advisory or Schneider Electric support. As immediate compensating controls: restrict access to the Modicon web interface to dedicated engineering VLANs with firewall rules blocking TCP port 80/443 from general corporate or external networks, which eliminates the network-reachable attack surface without impacting PLC operation. If the web interface is not operationally required, disable it in the PLC configuration - note this removes remote diagnostics capability. Enforce multi-factor authentication or certificate-based access on engineering workstations to raise the bar for credential compromise that would enable the initial authenticated foothold. Monitor web interface access logs for unexpected authenticated sessions or unusual user agents as a detection compensating control.
More in Modicon M251 Firmware
View allA Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware ver
An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmwa
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute
Partial Denial of Service against Schneider Electric Modicon M241, M251, and M262 programmable logic controllers (PLCs)
A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device
A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information t
Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that co
Scripting') vulnerability exists that could cause a vulnerability leading to a cross-site scripting condition where atta
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today