Modicon Lmc058 Firmware
Monthly
Cross-site scripting in Schneider Electric Modicon PLC embedded web servers (M258, LMC058, M251, M241) allows authenticated low-privilege attackers to inject persistent JavaScript payloads that execute in a victim engineer's browser upon hovering over a crafted element. In industrial OT environments, successful exploitation could compromise engineering workstation sessions, steal credentials used to configure programmable logic controllers, or manipulate displayed process data. No public exploit code exists and the CVE is absent from CISA KEV; EPSS at 0.05% (14th percentile) confirms low current exploitation likelihood, though the ICS context elevates operational consequence beyond what raw scores suggest.
Scripting') vulnerability exists that could cause a vulnerability leading to a cross-site scripting condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting in Schneider Electric Modicon PLC embedded web servers (M258, LMC058, M251, M241) allows authenticated low-privilege attackers to inject persistent JavaScript payloads that execute in a victim engineer's browser upon hovering over a crafted element. In industrial OT environments, successful exploitation could compromise engineering workstation sessions, steal credentials used to configure programmable logic controllers, or manipulate displayed process data. No public exploit code exists and the CVE is absent from CISA KEV; EPSS at 0.05% (14th percentile) confirms low current exploitation likelihood, though the ICS context elevates operational consequence beyond what raw scores suggest.
Scripting') vulnerability exists that could cause a vulnerability leading to a cross-site scripting condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.