# CVE-2025-13901: Schneider Electric Modicon M241/M251/M262 Machine Expert Protocol Partial Denial of Service (CWE-404)

> CVE-2025-13901 is an improper resource shutdown or release flaw (CWE-404) in Schneider Electric Modicon M241, M251 and M262 controllers. An unauthenticated network attacker can send a malicious payload that occupies active communication channels, causing a partial denial of service on the Machine Expert protocol. A firmware fix is available and no public exploitation has been reported.

- **Published:** 2026-10-24T05:36:07Z
- **Last reviewed:** 2026-10-24T05:36:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4348
- **ID:** TL-2026-4348
- **Severity:** MEDIUM (CVSS 5.3)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-13901

## Description

CVE-2025-13901 affects the Machine Expert protocol service of Schneider Electric Modicon M241, M251 and M262 programmable logic controllers. The weakness is classified as CWE-404 (Improper Resource Shutdown or Release). Per the CVE record, NVD and the CISA advisory, an unauthenticated attacker with network reach to the controller can send a malicious payload that occupies the active communication channels of the Machine Expert protocol. The result is a partial denial of service on that protocol: legitimate engineering and communication sessions can be blocked while the channels are held.

NVD scores the issue CVSS v3.1 5.3 (MEDIUM), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, with CVSS v4.0 6.9 (MEDIUM), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. Confidentiality and integrity are not affected; the impact is limited to low availability loss. The CISA ADP SSVC assessment lists Exploitation: None, Automatable: Yes, Technical Impact: Partial.

Vulnerable versions are Modicon M241/M251 firmware prior to 5.4.13.12 and Modicon M262 firmware prior to 5.4.10.12. Schneider Electric published advisory SEVD-2026-069-01 and the CVE record on 2026-03-10. CISA republished the issue as ICS advisory ICSA-26-078-01 on 2026-03-19. The flaw was reported through Claroty Team82's coordinated disclosure program (credit: Amir Zaltzman, Claroty Team82), and Team82 published its disclosure dashboard entry in March 2026.

Remediation is a firmware update through EcoStruxure Machine Expert v2.5.0.1 (M241/M251) or v2.5 (M262) using the Schneider Electric Software Installer. CISA also advises network isolation of control systems, firewall filtering, encrypted communications, and VPN for remote access. CISA states that no public exploitation specifically targeting this vulnerability has been reported to it, and Tenable lists no known exploits. No exploit code, IOCs, or threat-actor attribution have been published. The affected sectors listed by CISA are Commercial Facilities, Critical Manufacturing and Energy, deployed worldwide.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T0814 Denial of Service

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2025-13901](https://br.claroty.com/team82/disclosure-dashboard/cve-2025-13901)
- [Schneider Electric Security Notice SEVD-2026-069-01](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-01.pdf)
- [CISA ICS Advisory ICSA-26-078-01 - Schneider Electric Modicon Controllers](https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-01)
- [NVD - CVE-2025-13901](https://nvd.nist.gov/vuln/detail/CVE-2025-13901)
- [CVE Program record - CVE-2025-13901](https://cveawg.mitre.org/api/cve/CVE-2025-13901)
- [Tenable OT Plugin 505515 - Schneider Electric Modicon M241, M251, and M262 Improper Resource Shutdown or Release (CVE-2025-13901)](https://www.tenable.com/plugins/ot/505515)
- [CWE-404: Improper Resource Shutdown or Release](https://cwe.mitre.org/data/definitions/404.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4348