# CVE-2025-13902 - Schneider Electric Modicon M241/M251/M262 (and M258/LMC058) Controllers Stored Cross-Site Scripting (CWE-79)

> CVE-2025-13902 is a CWE-79 cross-site scripting flaw in the embedded web server of Schneider Electric Modicon M241/M251/M262 controllers (the CVE record also lists M258 and LMC058). An authenticated attacker can inject a payload that runs arbitrary JavaScript in a victim's browser when the victim hovers over the crafted element. No exploitation in the wild, public PoC or KEV listing is documented.

- **Published:** 2026-10-15T00:21:59Z
- **Last reviewed:** 2026-10-15T00:21:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3568
- **ID:** TL-2026-3568
- **Severity:** MEDIUM (CVSS 5.4)
- **Category:** ICS_SCADA
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-13902

## Description

CVE-2025-13902 was reserved on 2025-12-02 and published on 2026-03-10. It is disclosed through Schneider Electric security notice SEVD-2026-069 and listed on the Claroty Team82 disclosure dashboard. The CVE record text states that authenticated attackers can have a victim's browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload. The weakness class is CWE-79 (improper neutralization of input during web page generation).

Affected scope according to the CVE record: Modicon Controllers M241/M251 firmware prior to 5.4.13.12, and Modicon M258/LMC058 (all versions). The Claroty dashboard lists M241/M251/M262. Shodan CVEDB also maps the CVE to CPEs for M241/M251 firmware 4.0.3.20 and 5.1.9.1. Source discrepancy: the Claroty page and the hunt skeleton name M262, while the CVE record and CPE data name M258/LMC058 and do not name M262. The skeleton references advisory SEVD-2026-069-01 while the CVE record references SEVD-2026-069-02. The vendor PDFs could not be machine-parsed in this run, so fixed versions for M262 and any vendor workarounds are not confirmed here.

Severity: Tenable reports CVSS v3.0 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), CVSS v2 5.5 and CVSS v4.0 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N). The attack requires a low-privileged authenticated account plus user interaction (a hover) and changes scope to the victim's browser context. Shodan CVEDB reports KEV: No and EPSS 0.00234. No public PoC, exploitation reporting, named threat actor, network IOC or malware is associated with this CVE in any source reviewed.

Defensive relevance: the realistic abuse path is an authenticated user (or stolen/default credentials) planting a script payload in a web-served element of a controller's HTTP interface, which then executes in the session of an engineer or operator who views it. Impact is limited (low confidentiality and integrity per the CVSS vectors, no availability impact), but it can serve as a foothold against the engineering browser session in an OT environment. Defenders should inventory exposed Modicon web servers, restrict access, and apply the vendor firmware update where available.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.007 JavaScript
- T1204 User Execution
- T1185 Browser Session Hijacking

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2025-13902](https://it.claroty.com/team82/disclosure-dashboard/cve-2025-13902)
- [Schneider Electric Security Notice SEVD-2026-069-01](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-01.pdf)
- [Schneider Electric Security Notice SEVD-2026-069-02](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-02.pdf)
- [CVE Program record CVE-2025-13902](https://cveawg.mitre.org/api/cve/CVE-2025-13902)
- [Tenable OT plugin 505937 - Schneider Electric Modicon Controllers](https://www.tenable.com/plugins/ot/505937)
- [Shodan CVEDB - CVE-2025-13902](https://cvedb.shodan.io/cve/CVE-2025-13902)
- [CVEfeed - CVE-2025-13902](https://cvefeed.io/vuln/detail/CVE-2025-13902)
- [Stack.watch - CVE-2025-13902](https://stack.watch/vuln/CVE-2025-13902)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3568