Threat reportICS/SCADATL-2026-3568
CVE-2025-13902 - Schneider Electric Modicon M241/M251/M262 (and M258/LMC058) Controllers Stored Cross-Site Scripting (CWE-79)
CVE-2025-13902 (TL-2026-3568), also tracked as SEVD-2026-069-01, is a medium-severity ICS/SCADA threat scored CVSS 5.4, first published 2026-10-15. It has no confirmed attribution, affects Schneider Electric Modicon Controllers M241/M251, references 1 CVE (CVE-2025-13902), maps to 5 MITRE ATT&CK techniques (T1059.007, T1078, T1185), and is covered by 9 detection rules and 12 indicators of compromise.
- CVSS
- 5.4/10Medium
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-3568
- Threat ID
- TL-2026-3568
- Also known as
- SEVD-2026-069-01, SEVD-2026-069-02
- Severity
- MEDIUM
- CVSS
- 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
- Status
- MONITORING
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- manufacturing, energy, critical-infrastructure, industrial-automation
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
How CVE-2025-13902 works
CVE-2025-13902 is a CWE-79 cross-site scripting flaw in the embedded web server of Schneider Electric Modicon M241/M251/M262 controllers (the CVE record also lists M258 and LMC058). An authenticated attacker can inject a payload that runs arbitrary JavaScript in a victim's browser when the victim hovers over the crafted element. No exploitation in the wild, public PoC or KEV listing is documented.
CVE-2025-13902 was reserved on 2025-12-02 and published on 2026-03-10. It is disclosed through Schneider Electric security notice SEVD-2026-069 and listed on the Claroty Team82 disclosure dashboard. The CVE record text states that authenticated attackers can have a victim's browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload. The weakness class is CWE-79 (improper neutralization of input during web page generation).
Affected scope according to the CVE record: Modicon Controllers M241/M251 firmware prior to 5.4.13.12, and Modicon M258/LMC058 (all versions). The Claroty dashboard lists M241/M251/M262. Shodan CVEDB also maps the CVE to CPEs for M241/M251 firmware 4.0.3.20 and 5.1.9.1. Source discrepancy: the Claroty page and the hunt skeleton name M262, while the CVE record and CPE data name M258/LMC058 and do not name M262. The skeleton references advisory SEVD-2026-069-01 while the CVE record references SEVD-2026-069-02. The vendor PDFs could not be machine-parsed in this run, so fixed versions for M262 and any vendor workarounds are not confirmed here.
Severity: Tenable reports CVSS v3.0 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), CVSS v2 5.5 and CVSS v4.0 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N). The attack requires a low-privileged authenticated account plus user interaction (a hover) and changes scope to the victim's browser context. Shodan CVEDB reports KEV: No and EPSS 0.00234. No public PoC, exploitation reporting, named threat actor, network IOC or malware is associated with this CVE in any source reviewed.
Defensive relevance: the realistic abuse path is an authenticated user (or stolen/default credentials) planting a script payload in a web-served element of a controller's HTTP interface, which then executes in the session of an engineer or operator who views it. Impact is limited (low confidentiality and integrity per the CVSS vectors, no availability impact), but it can serve as a foothold against the engineering browser session in an OT environment. Defenders should inventory exposed Modicon web servers, restrict access, and apply the vendor firmware update where available.
MITRE ATT&CK techniques used in TL-2026-3568
Execution
T1059.007 JavaScript; T1204 User Execution
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Collection
Affected products and versions in CVE-2025-13902
- Schneider Electric — Modicon Controllers M241/M251
Vulnerable versions: firmware prior to 5.4.13.12
Fixed in: 5.4.13.12 - Schneider Electric — Modicon Controllers M258/LMC058
Vulnerable versions: all versions - Schneider Electric — Modicon Controller M262
Vulnerable versions: listed by Claroty Team82; versions not stated in sources reviewed
Remediation for CVE-2025-13902
Patches
- Modicon M241/M251: update firmware to 5.4.13.12 or later (CVE record lists versions prior to 5.4.13.12 as affected)
Immediate actions
- Identify Modicon M241/M251/M262/M258/LMC058 controllers with the embedded web server reachable and restrict access to trusted engineering networks
- Review and minimise accounts able to authenticate to the controller web server and rotate their credentials
- Read Schneider Electric notice SEVD-2026-069 (-01 and -02) for product-specific fixes and mitigations
Workarounds
- M258/LMC058: the CVE record lists all versions as affected; consult the vendor advisory for mitigations as no fixed version is stated in the sources reviewed
Longer-term hardening
- Segment OT networks and keep controller web interfaces off the internet
- Use hardened engineering workstations and browsers when accessing controller web interfaces
CVEs associated with CVE-2025-13902
Weaknesses (CWE) in CVE-2025-13902
Timeline of CVE-2025-13902
- CVE-2025-13902 reserved in the CVE Program.
- Patch publication date recorded as 2026-03-10; M241/M251 firmware 5.4.13.12 is the first non-vulnerable version per the CVE record.
- CVE record published; Schneider Electric advisory SEVD-2026-069 released and the vulnerability publication date recorded by Tenable.
- CVEfeed records the CVE entry as last modified.
- Tenable OT plugin 505937 published for Schneider Electric Modicon Controllers.
- Tenable OT plugin 505937 updated.
Sources cited for CVE-2025-13902
- Claroty Team82 Disclosure Dashboard - CVE-2025-13902
- Schneider Electric Security Notice SEVD-2026-069-01
- Schneider Electric Security Notice SEVD-2026-069-02
- CVE Program record CVE-2025-13902
- Tenable OT plugin 505937 - Schneider Electric Modicon Controllers
- Shodan CVEDB - CVE-2025-13902
- CVEfeed - CVE-2025-13902
- Stack.watch - CVE-2025-13902
Detection coverage for TL-2026-3568
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3568 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.