Threat reportICS/SCADATL-2026-4346
CVE-2025-13902: Stored/Reflected XSS (CWE-79) in Schneider Electric Modicon M241/M251/M258/LMC058 Controllers Web Server
CVE-2025-13902 (TL-2026-4346), also tracked as SEVD-2026-069-01, is a medium-severity ICS/SCADA threat scored CVSS 5.4, first published 2026-10-24. It has no confirmed attribution, affects Schneider Electric Modicon M241 / M251 Controllers, references 2 CVEs (CVE-2025-13902, CVE-2025-13901), maps to 5 MITRE ATT&CK techniques (T1059.007, T1078, T1185), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 5.4/10Medium
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4346
- Threat ID
- TL-2026-4346
- Also known as
- SEVD-2026-069-01, SEVD-2026-069-02
- Severity
- MEDIUM
- CVSS
- 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
- Status
- MONITORING
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- manufacturing, energy, industrial control systems, critical infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in CVE-2025-13902
Malware and tooling: EcoStruxure Machine Expert
How CVE-2025-13902 works
CVE-2025-13902 is a cross-site scripting flaw (CWE-79) in the embedded web server of Schneider Electric Modicon M241/M251 (and M258/LMC058) PLCs, disclosed by Claroty Team82 and covered by Schneider Electric security notice SEVD-2026-069. An authenticated attacker can plant a crafted element that runs arbitrary JavaScript in a victim's browser when they hover over it (CVSS 3.1 5.4 Medium). No in-the-wild exploitation or public PoC is stated in any source.
CVE-2025-13902 is an Improper Neutralization of Input During Web Page Generation (CWE-79) vulnerability in the web server of Schneider Electric Modicon controllers. Per the CVE record and NVD, an authenticated attacker can inject content so that a victim's browser executes arbitrary JavaScript when the victim hovers over a maliciously crafted element hosted on the affected web server. The CVE was reserved on 2025-12-02 and published on 2026-03-10; NVD was last modified on 2026-06-23.
Scoring: NVD lists CVSS 3.1 5.4 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) and CVSS 4.0 5.1 MEDIUM (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N). The attack is network-reachable and low complexity, but requires low privileges (a valid account on the controller web server) and user interaction (the victim must hover over the crafted element). Scope is changed because the script executes in the victim's browser context rather than on the controller, with limited confidentiality and integrity impact and no availability impact.
Affected products according to the CVE record/NVD: Modicon M241 and M251 firmware prior to 5.4.13.12, and Modicon M258 and LMC058 (all versions). The Claroty Team82 disclosure dashboard and the hunt skeleton name the M241/M251/M262 family; the CVE record does not list the M262 for this CVE, so M262 exposure should be confirmed against the vendor notice. Note also that the CVE record references SEVD-2026-069-02 while the Claroty page links SEVD-2026-069-01; the sibling vulnerability CVE-2025-13901 (CWE-404 partial denial of service over the Machine Expert protocol, CVSS 5.3) is covered by CISA ICSA-26-078-01 (released 2026-03-19) for M241/M251 before 5.4.13.12 and M262 before 5.4.10.12. The vendor PDFs could not be parsed as text during research, so fix and mitigation specifics beyond the version threshold are not independently confirmed.
Defensive relevance: although the XSS itself is Medium severity, it targets the engineering/HMI-style web interface of widely deployed PLCs. Exploitation would let an attacker with a low-privilege account pivot into an operator's or engineer's browser session. Exposure is reduced where controller web servers are not reachable from untrusted networks. No threat actor, malware, C2 infrastructure, exploitation in the wild, CISA KEV listing or public PoC is reported in the sources consulted.
MITRE ATT&CK techniques used in TL-2026-4346
Execution
T1059.007 Command and Scripting Interpreter: JavaScript; T1204 User Execution
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Collection
Affected products and versions in CVE-2025-13902
- Schneider Electric — Modicon M241 / M251 Controllers
Vulnerable versions: prior to 5.4.13.12
Fixed in: 5.4.13.12 - Schneider Electric — Modicon M258 / LMC058 Controllers
Vulnerable versions: all versions - Schneider Electric — Modicon M262 Controllers (named in Team82 disclosure; not listed in CVE record for this CVE)
Vulnerable versions: unconfirmed
Remediation for CVE-2025-13902
Patches
- Modicon M241/M251: update to firmware 5.4.13.12 or later via EcoStruxure Machine Expert per Schneider Electric notice SEVD-2026-069
Immediate actions
- Identify Modicon M241/M251 (firmware prior to 5.4.13.12) and M258/LMC058 controllers and restrict access to their web servers to trusted engineering networks only
- Review and minimize which accounts have access to the controller web server; rotate credentials for any shared or default accounts
- Avoid browsing controller web pages from the same browser profile used for other sensitive sessions
Workarounds
- Modicon M258/LMC058: all versions are listed as affected in the CVE record; no fixed version is stated in the sources reviewed, so apply the mitigations in the Schneider Electric notice and network isolation
Longer-term hardening
- Segment control networks and keep PLC web interfaces off the internet and corporate networks, behind firewalls and VPN for remote access
- Monitor HTTP requests to controller web servers for script content or unusual parameters
CVEs associated with CVE-2025-13902
Weaknesses (CWE) in CVE-2025-13902
Timeline of CVE-2025-13902
- CVE-2025-13902 reserved (CVE record)
- Firmware 5.4.13.12 is the first non-vulnerable version for Modicon M241/M251; M258/LMC058 listed as all versions affected
- Sibling Modicon vulnerability CVE-2025-13901 (CWE-404 partial DoS over Machine Expert protocol, CVSS 5.3) published the same day
- CVE-2025-13902 published; Schneider Electric security notice SEVD-2026-069 released for Modicon M241/M251 and M258/LMC058 (CWE-79 XSS, CVSS 5.4)
- CISA releases ICSA-26-078-01 for Modicon M241/M251/M262 covering CVE-2025-13901 (credits Claroty Team82); it does not mention CVE-2025-13902
- NVD record for CVE-2025-13902 last modified with CVSS 3.1 5.4 and CVSS 4.0 5.1 scoring
Sources cited for CVE-2025-13902
- Claroty Team82 Disclosure Dashboard - CVE-2025-13902
- Schneider Electric Security Notice SEVD-2026-069-01
- Schneider Electric Security Notice SEVD-2026-069-02 (referenced by CVE record)
- NVD - CVE-2025-13902
- CVE Record - CVE-2025-13902
- CISA ICSA-26-078-01 - Schneider Electric Modicon (sibling CVE-2025-13901)
- Tenable OT plugin 505937 - CVE-2025-13902
Detection coverage for TL-2026-4346
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4346 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.