Vulnerability details

CVE-2025-3898

Schneider Electric Modicon Controllers M241 / M251Schneider Electric Modicon Controllers M262

CVSS 4.0

7.1High

Official description

CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends HTTPS request containing invalid data type to the webserver.

CVSS scores

Score	Version	Source	Vector
7.1High	4.0	CVEProject cvelistV5 (CNA) (schneider)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`
6.5Medium	3.1	CVEProject cvelistV5 (CNA) (schneider)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

Affected products

Vendor	Product	Versions	Source
Schneider Electric	Modicon Controllers M241 / M251	Versions prior to 5.3.12.51	CVEProject cvelistV5 (CNA)
Schneider Electric	Modicon Controllers M262	Versions prior to 5.3.9.18	CVEProject cvelistV5 (CNA)

References and advisories

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-161-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-161-02.pdf

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-06-10
Last updated: 2025-06-10
State: Published
Assigner (CNA): schneider

Exploit prediction (EPSS)

0.55%

Probability of exploitation in 30 days

46.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-20
Improper Input Validation