# CVE-2025-13901: Schneider Electric Modicon M241/M251/M262 Machine Expert Protocol Partial Denial of Service (CWE-404)

> An unauthenticated network attacker can send a malicious payload to Schneider Electric Modicon M241, M251 and M262 controllers that occupies active communication channels, causing a partial denial of service on the Machine Expert protocol. Fixed firmware is delivered with EcoStruxure Machine Expert v2.5 / v2.5.0.1; no public exploitation was reported to CISA.

- **Published:** 2026-10-15T00:39:33Z
- **Last reviewed:** 2026-10-15T00:39:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3570
- **ID:** TL-2026-3570
- **Severity:** MEDIUM (CVSS 5.3)
- **Category:** ICS_SCADA
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-13901

## Description

CVE-2025-13901 is a CWE-404 (Improper Resource Shutdown or Release) weakness in the Machine Expert protocol implementation of Schneider Electric Modicon M241, M251 and M262 programmable logic controllers. Per the vendor advisory SEVD-2026-069-01 and CISA advisory ICSA-26-078-01, an unauthenticated attacker who can reach the controller over the network can send a malicious payload that occupies the controller's active communication channels, producing a partial denial of service on the Machine Expert protocol. The vendor warns that failing to remediate may risk a denial-of-service attack resulting in loss of availability of the controller.

Scoring: CVSS 3.1 base 5.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L; NVD also records CVSS 4.0 base 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. Impact is limited to availability (low); there is no confidentiality or integrity impact. The Machine Expert protocol is the engineering/programming channel used by EcoStruxure Machine Expert and is documented by Schneider as using TCP 1105 and 11740 and UDP 1740-1743 (11740 is the Fast TCP port used with M262).

Affected: Modicon M241 and M251 firmware prior to 5.4.13.12; Modicon M262 firmware prior to 5.4.10.12. Fixes: M251 firmware 5.4.13.12 delivered with EcoStruxure Machine Expert v2.5.0.1 (CISA lists the v2.5.0.1 installer as the update path for the family); M262 firmware 5.4.10.12 delivered with EcoStruxure Machine Expert v2.5. Vendor mitigations: deploy controllers only in protected environments with minimal network exposure, filter ports and IPs via the embedded firewall, use encrypted communication links, use VPN tunnels for remote access, and isolate control system networks behind firewalls from business networks.

The issue was reported by Amir Zaltzman of Claroty Team82 and is listed on the Team82 disclosure dashboard. CISA reports no known public exploitation and lists affected sectors as Commercial Facilities, Critical Manufacturing and Energy, deployed worldwide. No public PoC, specific exploit payload format, or threat-actor activity is documented in the sources; the MITRE mappings below are therefore limited to the technique classes implied by the advisory's attack description.

## MITRE ATT&CK

- T1595 Active Scanning
- T1046 Network Service Discovery
- T0814 Denial of Service
- T1499.002 Service Exhaustion Flood

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2025-13901](https://it.claroty.com/team82/disclosure-dashboard/cve-2025-13901)
- [Schneider Electric SEVD-2026-069-01: Improper Resource Shutdown or Release vulnerability in Multiple Products](https://www.se.com/us/en/download/document/SEVD-2026-069-01/)
- [Schneider Electric SEVD-2026-069-01 (PDF)](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-01.pdf)
- [CISA ICS Advisory ICSA-26-078-01: Schneider Electric Modicon M241, M251, and M262](https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-01)
- [NVD - CVE-2025-13901](https://nvd.nist.gov/vuln/detail/CVE-2025-13901)
- [SEVD-2026-069-01 - Vulnerability-Lookup (CIRCL)](https://vulnerability.circl.lu/vuln/sevd-2026-069-01)
- [Tenable OT Security plugin 505515 - Schneider Electric Modicon M241, M251, and M262 Improper Resource Shutdown or Release (CVE-2025-13901)](https://www.tenable.com/plugins/ot/505515)
- [OpenCVE - CVE-2025-13901](https://app.opencve.io/cve/CVE-2025-13901)
- [Schneider Electric FAQ: Connecting to M262 from EcoStruxure Machine Expert (ports 1105 / 11740)](https://www.se.com/kr/ko/faqs/FA383096/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3570