Read the docs
TI-2025-12704 Aliases CVE-2025-13902GHSA-pm47-v83p-5qpg

Cross-site scripting in Schneider Electric Modicon Controllers M241/M251

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0027 19th percentileScored 2026-11-07
Fix Fixed Modicon Controllers M241/M251 (Schneider Electric): 5.4.13.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Schneider ElectricModicon Controllers M241/M251before 5.4.13.125.4.13.12Patch availableCNA
Schneider ElectricModicon Controllers M258/LMC058All versions—No fix listedCNA
  • Modicon Controllers M241/M251 VendorSchneider Electric Affected before 5.4.13.12 Fixed in 5.4.13.12 Patch available CNA
  • Modicon Controllers M258/LMC058 VendorSchneider Electric Affected All versions Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:o:schneider-electric:modicon_m258_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableSchneider Electric
cpe:2.3:h:schneider-electric:modicon_m258:-:*:*:*:*:*:*:*not specified by NVDRunning onSchneider Electric
cpe:2.3:o:schneider-electric:modicon_lmc058_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableSchneider Electric
cpe:2.3:h:schneider-electric:modicon_lmc058:-:*:*:*:*:*:*:*not specified by NVDRunning onSchneider Electric
cpe:2.3:o:schneider-electric:modicon_m251_firmware:*:*:*:*:*:*:*:*before 5.4.13.12VulnerableSchneider Electric
cpe:2.3:h:schneider-electric:modicon_m251:-:*:*:*:*:*:*:*not specified by NVDRunning onSchneider Electric
cpe:2.3:o:schneider-electric:modicon_m241_firmware:*:*:*:*:*:*:*:*before 5.4.13.12VulnerableSchneider Electric
cpe:2.3:h:schneider-electric:modicon_m241:-:*:*:*:*:*:*:*not specified by NVDRunning onSchneider Electric
  • cpe:2.3:o:schneider-electric:modicon_m258_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Schneider Electric
  • cpe:2.3:h:schneider-electric:modicon_m258:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
  • cpe:2.3:o:schneider-electric:modicon_lmc058_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Schneider Electric
  • cpe:2.3:h:schneider-electric:modicon_lmc058:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
  • cpe:2.3:o:schneider-electric:modicon_m251_firmware:*:*:*:*:*:*:*:* Versions before 5.4.13.12 Vulnerable ·Schneider Electric
  • cpe:2.3:h:schneider-electric:modicon_m251:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
  • cpe:2.3:o:schneider-electric:modicon_m241_firmware:*:*:*:*:*:*:*:* Versions before 5.4.13.12 Vulnerable ·Schneider Electric
  • cpe:2.3:h:schneider-electric:modicon_m241:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric

Remediation

  • Fix · CNA Modicon Controllers M241/M251 (Schneider Electric) Fixed in 5.4.13.12

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-13902
  2. 2026-10-03 Alias added: GHSA-pm47-v83p-5qpg

References

Patch 1

  • TI-2019-04853 Missing authentication in Modicon and PacDrive Controller, All versions of: Modicon M100… CVSS 3.1HIGH 8.2
  • TI-2024-06054 Cross-site scripting in Schneider Electric Modicon Controllers M241 / M251 CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences