# CVE-2025-13902: Stored/Reflected XSS (CWE-79) in Schneider Electric Modicon M241/M251/M258/LMC058 Controllers Web Server

> CVE-2025-13902 is a cross-site scripting flaw (CWE-79) in the embedded web server of Schneider Electric Modicon M241/M251 (and M258/LMC058) PLCs, disclosed by Claroty Team82 and covered by Schneider Electric security notice SEVD-2026-069. An authenticated attacker can plant a crafted element that runs arbitrary JavaScript in a victim's browser when they hover over it (CVSS 3.1 5.4 Medium). No in-the-wild exploitation or public PoC is stated in any source.

- **Published:** 2026-10-24T05:11:13Z
- **Last reviewed:** 2026-10-24T05:11:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4346
- **ID:** TL-2026-4346
- **Severity:** MEDIUM (CVSS 5.4)
- **Category:** ICS_SCADA
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-13902, CVE-2025-13901

## Description

CVE-2025-13902 is an Improper Neutralization of Input During Web Page Generation (CWE-79) vulnerability in the web server of Schneider Electric Modicon controllers. Per the CVE record and NVD, an authenticated attacker can inject content so that a victim's browser executes arbitrary JavaScript when the victim hovers over a maliciously crafted element hosted on the affected web server. The CVE was reserved on 2025-12-02 and published on 2026-03-10; NVD was last modified on 2026-06-23.

Scoring: NVD lists CVSS 3.1 5.4 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) and CVSS 4.0 5.1 MEDIUM (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N). The attack is network-reachable and low complexity, but requires low privileges (a valid account on the controller web server) and user interaction (the victim must hover over the crafted element). Scope is changed because the script executes in the victim's browser context rather than on the controller, with limited confidentiality and integrity impact and no availability impact.

Affected products according to the CVE record/NVD: Modicon M241 and M251 firmware prior to 5.4.13.12, and Modicon M258 and LMC058 (all versions). The Claroty Team82 disclosure dashboard and the hunt skeleton name the M241/M251/M262 family; the CVE record does not list the M262 for this CVE, so M262 exposure should be confirmed against the vendor notice. Note also that the CVE record references SEVD-2026-069-02 while the Claroty page links SEVD-2026-069-01; the sibling vulnerability CVE-2025-13901 (CWE-404 partial denial of service over the Machine Expert protocol, CVSS 5.3) is covered by CISA ICSA-26-078-01 (released 2026-03-19) for M241/M251 before 5.4.13.12 and M262 before 5.4.10.12. The vendor PDFs could not be parsed as text during research, so fix and mitigation specifics beyond the version threshold are not independently confirmed.

Defensive relevance: although the XSS itself is Medium severity, it targets the engineering/HMI-style web interface of widely deployed PLCs. Exploitation would let an attacker with a low-privilege account pivot into an operator's or engineer's browser session. Exposure is reduced where controller web servers are not reachable from untrusted networks. No threat actor, malware, C2 infrastructure, exploitation in the wild, CISA KEV listing or public PoC is reported in the sources consulted.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1204 User Execution
- T1185 Browser Session Hijacking

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2025-13902](https://br.claroty.com/team82/disclosure-dashboard/cve-2025-13902)
- [Schneider Electric Security Notice SEVD-2026-069-01](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-01.pdf)
- [Schneider Electric Security Notice SEVD-2026-069-02 (referenced by CVE record)](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-02.pdf)
- [NVD - CVE-2025-13902](https://nvd.nist.gov/vuln/detail/CVE-2025-13902)
- [CVE Record - CVE-2025-13902](https://cveawg.mitre.org/api/cve/CVE-2025-13902)
- [CISA ICSA-26-078-01 - Schneider Electric Modicon (sibling CVE-2025-13901)](https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-01)
- [Tenable OT plugin 505937 - CVE-2025-13902](https://www.tenable.com/plugins/ot/505937)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4346