Threat reportVulnerabilityTL-2026-4348
CVE-2025-13901: Schneider Electric Modicon M241/M251/M262 Machine Expert Protocol Partial Denial of Service (CWE-404)
CVE-2025-13901 (TL-2026-4348), also tracked as SEVD-2026-069-01, is a medium-severity software vulnerability scored CVSS 5.3, first published 2026-10-24. It has no confirmed attribution, affects Schneider Electric Modicon M241, references 1 CVE (CVE-2025-13901), maps to 2 MITRE ATT&CK techniques (T0814, T1190), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 5.3/10Medium
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 2MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4348
- Threat ID
- TL-2026-4348
- Also known as
- SEVD-2026-069-01, ICSA-26-078-01
- Severity
- MEDIUM
- CVSS
- 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- commercial facilities, critical manufacturing, energy
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in CVE-2025-13901
Malware and tooling: EcoStruxure Machine Expert v2.5.0.1
How CVE-2025-13901 works
CVE-2025-13901 is an improper resource shutdown or release flaw (CWE-404) in Schneider Electric Modicon M241, M251 and M262 controllers. An unauthenticated network attacker can send a malicious payload that occupies active communication channels, causing a partial denial of service on the Machine Expert protocol. A firmware fix is available and no public exploitation has been reported.
CVE-2025-13901 affects the Machine Expert protocol service of Schneider Electric Modicon M241, M251 and M262 programmable logic controllers. The weakness is classified as CWE-404 (Improper Resource Shutdown or Release). Per the CVE record, NVD and the CISA advisory, an unauthenticated attacker with network reach to the controller can send a malicious payload that occupies the active communication channels of the Machine Expert protocol. The result is a partial denial of service on that protocol: legitimate engineering and communication sessions can be blocked while the channels are held.
NVD scores the issue CVSS v3.1 5.3 (MEDIUM), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, with CVSS v4.0 6.9 (MEDIUM), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. Confidentiality and integrity are not affected; the impact is limited to low availability loss. The CISA ADP SSVC assessment lists Exploitation: None, Automatable: Yes, Technical Impact: Partial.
Vulnerable versions are Modicon M241/M251 firmware prior to 5.4.13.12 and Modicon M262 firmware prior to 5.4.10.12. Schneider Electric published advisory SEVD-2026-069-01 and the CVE record on 2026-03-10. CISA republished the issue as ICS advisory ICSA-26-078-01 on 2026-03-19. The flaw was reported through Claroty Team82's coordinated disclosure program (credit: Amir Zaltzman, Claroty Team82), and Team82 published its disclosure dashboard entry in March 2026.
Remediation is a firmware update through EcoStruxure Machine Expert v2.5.0.1 (M241/M251) or v2.5 (M262) using the Schneider Electric Software Installer. CISA also advises network isolation of control systems, firewall filtering, encrypted communications, and VPN for remote access. CISA states that no public exploitation specifically targeting this vulnerability has been reported to it, and Tenable lists no known exploits. No exploit code, IOCs, or threat-actor attribution have been published. The affected sectors listed by CISA are Commercial Facilities, Critical Manufacturing and Energy, deployed worldwide.
MITRE ATT&CK techniques used in TL-2026-4348
Inhibit Response Function
Initial Access
Affected products and versions in CVE-2025-13901
- Schneider Electric — Modicon M241
Vulnerable versions: prior to 5.4.13.12
Fixed in: 5.4.13.12 (EcoStruxure Machine Expert v2.5.0.1) - Schneider Electric — Modicon M251
Vulnerable versions: prior to 5.4.13.12
Fixed in: 5.4.13.12 (EcoStruxure Machine Expert v2.5.0.1) - Schneider Electric — Modicon M262
Vulnerable versions: prior to 5.4.10.12
Fixed in: 5.4.10.12 (EcoStruxure Machine Expert v2.5)
Remediation for CVE-2025-13901
Patches
- Modicon M241/M251: update firmware to 5.4.13.12 or later via EcoStruxure Machine Expert v2.5.0.1 and the Schneider Electric Software Installer
- Modicon M262: update firmware to 5.4.10.12 or later via EcoStruxure Machine Expert v2.5 and the Schneider Electric Software Installer
- See Schneider Electric advisory SEVD-2026-069-01
Immediate actions
- Restrict network access to Modicon M241/M251/M262 controllers so that only trusted engineering workstations can reach the Machine Expert protocol service
- Place controllers behind firewalls and isolate control-system networks from business networks and the internet
- Use VPN for any required remote access, and keep the VPN itself updated
Workarounds
- Apply network isolation and firewall filtering where the firmware cannot yet be updated
Longer-term hardening
- Use encrypted communications for control-system traffic where supported
- Monitor for abnormal Machine Expert protocol session behavior and stalled or exhausted communication channels on controllers
- Follow Schneider Electric and CISA ICS cybersecurity best-practice guidance for network segmentation
CVEs associated with CVE-2025-13901
Weaknesses (CWE) in CVE-2025-13901
Timeline of CVE-2025-13901
- Schneider Electric publishes security notice SEVD-2026-069-01 with fixed firmware. Tenable records the vulnerability and patch as published on this date.
- CVE-2025-13901 is published in the CVE Program/NVD record, with CWE-404 and affected versions: M241/M251 prior to 5.4.13.12 and M262 prior to 5.4.10.12.
- CISA releases ICS advisory ICSA-26-078-01 for the Modicon controllers. It credits Amir Zaltzman of Claroty Team82 and states no public exploitation has been reported to CISA.
- Claroty Team82 publicly discloses the Modicon M241/M251/M262 denial-of-service vulnerabilities on its disclosure dashboard, following coordinated private notification to the vendor.
- The NVD record is last modified. Tenable publishes OT plugin 505515 for detecting the vulnerability, reporting CVSS v3 5.3, v4 6.9 and no known exploits.
- Tenable OT plugin 505515 is updated. No known exploit is listed.
Sources cited for CVE-2025-13901
- Claroty Team82 Disclosure Dashboard - CVE-2025-13901
- Schneider Electric Security Notice SEVD-2026-069-01
- CISA ICS Advisory ICSA-26-078-01 - Schneider Electric Modicon Controllers
- NVD - CVE-2025-13901
- CVE Program record - CVE-2025-13901
- Tenable OT Plugin 505515 - Schneider Electric Modicon M241, M251, and M262 Improper Resource Shutdown or Release (CVE-2025-13901)
- CWE-404: Improper Resource Shutdown or Release
Detection coverage for TL-2026-4348
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4348 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.