Threat reportICS/SCADATL-2026-3570
CVE-2025-13901: Schneider Electric Modicon M241/M251/M262 Machine Expert Protocol Partial Denial of Service (CWE-404)
CVE-2025-13901 (TL-2026-3570), also tracked as SEVD-2026-069-01, is a medium-severity ICS/SCADA threat scored CVSS 5.3, first published 2026-10-15. It has no confirmed attribution, affects Schneider Electric Modicon M241, references 1 CVE (CVE-2025-13901), maps to 4 MITRE ATT&CK techniques (T0814, T1046, T1499.002), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 5.3/10Medium
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3570
- Threat ID
- TL-2026-3570
- Also known as
- SEVD-2026-069-01, ICSA-26-078-01
- Severity
- MEDIUM
- CVSS
- 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
- Status
- PATCHED
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- commercial facilities, critical manufacturing, energy
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in CVE-2025-13901
Malware and tooling: EcoStruxure Machine Expert
How CVE-2025-13901 works
An unauthenticated network attacker can send a malicious payload to Schneider Electric Modicon M241, M251 and M262 controllers that occupies active communication channels, causing a partial denial of service on the Machine Expert protocol. Fixed firmware is delivered with EcoStruxure Machine Expert v2.5 / v2.5.0.1; no public exploitation was reported to CISA.
CVE-2025-13901 is a CWE-404 (Improper Resource Shutdown or Release) weakness in the Machine Expert protocol implementation of Schneider Electric Modicon M241, M251 and M262 programmable logic controllers. Per the vendor advisory SEVD-2026-069-01 and CISA advisory ICSA-26-078-01, an unauthenticated attacker who can reach the controller over the network can send a malicious payload that occupies the controller's active communication channels, producing a partial denial of service on the Machine Expert protocol. The vendor warns that failing to remediate may risk a denial-of-service attack resulting in loss of availability of the controller.
Scoring: CVSS 3.1 base 5.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L; NVD also records CVSS 4.0 base 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. Impact is limited to availability (low); there is no confidentiality or integrity impact. The Machine Expert protocol is the engineering/programming channel used by EcoStruxure Machine Expert and is documented by Schneider as using TCP 1105 and 11740 and UDP 1740-1743 (11740 is the Fast TCP port used with M262).
Affected: Modicon M241 and M251 firmware prior to 5.4.13.12; Modicon M262 firmware prior to 5.4.10.12. Fixes: M251 firmware 5.4.13.12 delivered with EcoStruxure Machine Expert v2.5.0.1 (CISA lists the v2.5.0.1 installer as the update path for the family); M262 firmware 5.4.10.12 delivered with EcoStruxure Machine Expert v2.5. Vendor mitigations: deploy controllers only in protected environments with minimal network exposure, filter ports and IPs via the embedded firewall, use encrypted communication links, use VPN tunnels for remote access, and isolate control system networks behind firewalls from business networks.
The issue was reported by Amir Zaltzman of Claroty Team82 and is listed on the Team82 disclosure dashboard. CISA reports no known public exploitation and lists affected sectors as Commercial Facilities, Critical Manufacturing and Energy, deployed worldwide. No public PoC, specific exploit payload format, or threat-actor activity is documented in the sources; the MITRE mappings below are therefore limited to the technique classes implied by the advisory's attack description.
MITRE ATT&CK techniques used in TL-2026-3570
Inhibit Response Function
Discovery
T1046 Network Service Discovery
Impact
T1499.002 Service Exhaustion Flood
Reconnaissance
Affected products and versions in CVE-2025-13901
- Schneider Electric — Modicon M241
Vulnerable versions: firmware prior to 5.4.13.12
Fixed in: 5.4.13.12 - Schneider Electric — Modicon M251
Vulnerable versions: firmware prior to 5.4.13.12
Fixed in: 5.4.13.12 (EcoStruxure Machine Expert v2.5.0.1) - Schneider Electric — Modicon M262
Vulnerable versions: firmware prior to 5.4.10.12
Fixed in: 5.4.10.12 (EcoStruxure Machine Expert v2.5)
Remediation for CVE-2025-13901
Patches
- Modicon M241/M251: update firmware to 5.4.13.12 or later via EcoStruxure Machine Expert v2.5.0.1
- Modicon M262: update firmware to 5.4.10.12 or later via EcoStruxure Machine Expert v2.5
Immediate actions
- Restrict network access to Machine Expert protocol ports (TCP 1105, TCP 11740, UDP 1740-1743) using the controller's embedded firewall and upstream firewalls
- Ensure controllers are not exposed to the Internet or business networks
Workarounds
- Filter ports and IP addresses with the controller embedded firewall
- Restrict Machine Expert protocol access to trusted engineering workstations
Longer-term hardening
- Deploy controllers only in protected environments with minimal network exposure
- Use encrypted communication links and VPN tunnels for remote access
- Isolate control system networks behind firewalls from business networks
- Monitor ICS network traffic for abnormal connection counts to controller engineering ports
CVEs associated with CVE-2025-13901
Weaknesses (CWE) in CVE-2025-13901
Timeline of CVE-2025-13901
- Affected versions recorded as Modicon M241/M251 prior to 5.4.13.12 and M262 prior to 5.4.10.12
- CVE-2025-13901 published in NVD (CWE-404; CVSS 3.1 5.3 and CVSS 4.0 6.9) referencing Schneider Electric advisory SEVD-2026-069-01
- CISA publishes ICS advisory ICSA-26-078-01 for Modicon M241, M251 and M262, crediting Amir Zaltzman of Claroty Team82; no known public exploitation reported
- Claroty Team82 publicly discloses the Modicon M241, M251 and M262 vulnerabilities (listed on its disclosure dashboard) that can lead to a denial-of-service condition on the controller
- Schneider Electric SEVD-2026-069-01 document version 1.1 lists remediation: firmware 5.4.13.12 (M251, Machine Expert v2.5.0.1) and 5.4.10.12 (M262, Machine Expert v2.5)
- Tenable OT Security publishes remote detection plugin tenable_ot_schneider_CVE-2025-13901.nasl (plugin 505515); no known exploits reported
- NVD record for CVE-2025-13901 last modified
- Tenable OT plugin 505515 updated to version 1.4
Sources cited for CVE-2025-13901
- Claroty Team82 Disclosure Dashboard - CVE-2025-13901
- Schneider Electric SEVD-2026-069-01: Improper Resource Shutdown or Release vulnerability in Multiple Products
- Schneider Electric SEVD-2026-069-01 (PDF)
- CISA ICS Advisory ICSA-26-078-01: Schneider Electric Modicon M241, M251, and M262
- NVD - CVE-2025-13901
- SEVD-2026-069-01 - Vulnerability-Lookup (CIRCL)
- Tenable OT Security plugin 505515 - Schneider Electric Modicon M241, M251, and M262 Improper Resource Shutdown or Release (CVE-2025-13901)
- OpenCVE - CVE-2025-13901
- Schneider Electric FAQ: Connecting to M262 from EcoStruxure Machine Expert (ports 1105 / 11740)
Detection coverage for TL-2026-3570
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3570 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.