Read the docs
TI-2025-02721 Aliases CVE-2025-3116GHSA-xmv7-64fr-2r3x

Improper input validation in Schneider Electric Modicon Controllers M241/M251

Priority LOW 32CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends special malformed HTTPS request containing improper formatted body data to the controller.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00483 41st percentileScored 2026-11-07
Fix Fixed Modicon Controllers M241/M251 (Schneider Electric): 5.3.12.51

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Schneider ElectricModicon Controllers M241/M251before 5.3.12.515.3.12.51Patch availableCNA
Schneider ElectricModicon Controllers M258 / LMC058All Versions—No fix listedCNA
  • Modicon Controllers M241/M251 VendorSchneider Electric Affected before 5.3.12.51 Fixed in 5.3.12.51 Patch available CNA
  • Modicon Controllers M258 / LMC058 VendorSchneider Electric Affected All Versions Fixed in — No fix listed CNA

Remediation

  • Fix · CNA Modicon Controllers M241/M251 (Schneider Electric) Fixed in 5.3.12.51

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-3116
  2. 2026-10-03 Alias added: GHSA-xmv7-64fr-2r3x

References

Other 1

  • TI-2018-05679 SQL injection in U.motion Builder software version 1.3.4 KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05589 Hard-coded credentials in EVlink City , EVlink Parking , and EVlink Smart Wallbox CVSS 3.1CRITICAL 9.8
  • TI-2022-15561 OS command injection in Schneider Electric SpaceLogic C-Bus Home Controller CVSS 3.1HIGH 8.8
  • TI-2023-04970 Path traversal in Schneider Electric C-Bus Toolkit CVSS 3.1CRITICAL 9.8
  • TI-2019-04862 Improper handling of exceptional conditions in Schneider Electric Modicon M580 CVSS 3.1HIGH 7.5
  • TI-2018-05690 Improper handling of exceptional conditions in Modicon M580 Modicon M340 Modicon Quantum… CVSS 3.1HIGH 7.5
See all 888 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences