Read the docs
TI-2025-03444 Aliases CVE-2025-3898GHSA-hxx3-p6px-cf6j

Improper input validation in Schneider Electric Modicon Controllers M241/M251

Priority LOW 32CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends HTTPS request containing invalid data type to the webserver.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00554 46th percentileScored 2026-11-07
Fix Fixed Modicon Controllers M241/M251 (Schneider Electric): 5.3.12.51Modicon Controllers M262 (Schneider Electric): 5.3.9.18

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Schneider ElectricModicon Controllers M241/M251before 5.3.12.515.3.12.51Patch availableCNA
Schneider ElectricModicon Controllers M262before 5.3.9.185.3.9.18Patch availableCNA
  • Modicon Controllers M241/M251 VendorSchneider Electric Affected before 5.3.12.51 Fixed in 5.3.12.51 Patch available CNA
  • Modicon Controllers M262 VendorSchneider Electric Affected before 5.3.9.18 Fixed in 5.3.9.18 Patch available CNA

Remediation

  • Fix · CNA Modicon Controllers M241/M251 (Schneider Electric) Fixed in 5.3.12.51
  • Fix · CNA Modicon Controllers M262 (Schneider Electric) Fixed in 5.3.9.18

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-3898
  2. 2026-10-03 Alias added: GHSA-hxx3-p6px-cf6j

References

Other 1

  • TI-2018-05679 SQL injection in U.motion Builder software version 1.3.4 KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05589 Hard-coded credentials in EVlink City , EVlink Parking , and EVlink Smart Wallbox CVSS 3.1CRITICAL 9.8
  • TI-2022-15561 OS command injection in Schneider Electric SpaceLogic C-Bus Home Controller CVSS 3.1HIGH 8.8
  • TI-2023-04970 Path traversal in Schneider Electric C-Bus Toolkit CVSS 3.1CRITICAL 9.8
  • TI-2019-04862 Improper handling of exceptional conditions in Schneider Electric Modicon M580 CVSS 3.1HIGH 7.5
  • TI-2018-05690 Improper handling of exceptional conditions in Modicon M580 Modicon M340 Modicon Quantum… CVSS 3.1HIGH 7.5
See all 888 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences