Skip to navigation

Threat reportVulnerabilityTL-2026-5899

CVE-2025-13902: Authenticated Cross-Site Scripting (CWE-79) in Schneider Electric Modicon M241/M251/M258/LMC058 Controller Web Server (Claroty also lists M262)

mediumTRACKING

CVE-2025-13902 is a CWE-79 cross-site scripting flaw in the embedded web server of Schneider Electric Modicon M241/M251 controllers (fixed in firmware 5.4.13.12) and M258/LMC058 (all versions, no fix listed). An authenticated attacker can plant a payload that runs arbitrary JavaScript in a victim's browser when the victim hovers over a crafted element. First disclosed .

Key facts

IdentifiersTL-2026-5899, CVE-2025-13902, CVE-2025-13901
Also known asSEVD-2026-069-02
SeverityMEDIUM
CVSS5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
First disclosed
EPSSCVE-2025-13901: 0.4% (41.7th percentile); CVE-2025-13902: 0.2% (15.0th percentile)
Affected productsSchneider Electric Modicon M241; Schneider Electric Modicon M251; Schneider Electric Modicon M258; Schneider Electric Modicon LMC058
Weaknesses (CWE)CWE-79
ToolsEcoStruxure Machine Expert v2.5.0.1
MITRE ATT&CK techniquesT0819 Exploit Public-Facing Application, T0859 Valid Accounts, T1059.007 JavaScript, T1078 Valid Accounts, T1185 Browser Session Hijacking, T1190 Exploit Public-Facing Application, T1204 User Execution
MotivationUNKNOWN
Target sectorsmanufacturing, energy, critical-infrastructure, industrial-automation
Target regionsGlobal
Detection rules9 (1 shown free)
Sources7 cited sources

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5899 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2025-13902 Modicon Web Session Cookie Replay From Multiple Sources — Post-Exploitation (SPL)

Detects one controller web session cookie presented from more than one source IP within 24 hours. A script injected through CVE-2025-13902 (CWE-79) runs in the victim's browser session and can lead to session theft or hijack (vendor-noted account takeover); replaying the stolen cookie from the attacker's host shows up as a single session hash with several client IPs. Cookies are hashed with md5 so no raw token is stored in results.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1185, T1539, T1078
  • Data sources: splunk_stream_http, network_traffic, web_proxy
  • Severity: medium
  • Confidence: medium

Splunk SPL

earliest=-24h index=network sourcetype="stream:http" dest_port IN (80,443) cookie=* | eval session_hash=md5(cookie) | stats count dc(src_ip) as src_count values(src_ip) as src_ips dc(http_user_agent) as ua_count values(http_user_agent) as user_agents values(http_method) as methods min(_time) as first_seen max(_time) as last_seen by dest_ip session_hash | where src_count>1 | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | table first_seen last_seen dest_ip session_hash src_count src_ips ua_count user_agents methods count

Microsoft KQL

CommonSecurityLog | where TimeGenerated > ago(24h) | where DestinationPort in (80, 443) | where isnotempty(RequestCookies) | extend SessionHash = hash_sha256(RequestCookies) | summarize SourceCount = dcount(SourceIP), SourceIPs = make_set(SourceIP, 10), AgentCount = dcount(RequestClientApplication), Requests = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DestinationIP, SessionHash | where SourceCount > 1

Sigma

title: CVE-2025-13902 Session Token Exfiltration Indicators in Outbound Proxy Request
id: 2f9b84d6-61a3-4c0e-b7d5-8e3a0c4f7d12
status: experimental
description: Detects outbound proxy requests carrying cookie or session-token parameters or document.cookie references, consistent with script injected through CVE-2025-13902 (CWE-79, Schneider Electric Modicon controller web server) stealing a victim's session for hijack or account takeover.
references:
    - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-02.pdf
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.collection
    - attack.t1185
    - attack.credential_access
    - attack.t1539
    - attack.initial_access
    - attack.t1078
    - cve.2025.13902
logsource:
    category: proxy
detection:
    selection:
        cs-uri-query|contains:
            - 'document.cookie'
            - 'cookie='
            - 'sessionid='
            - 'session_id='
            - 'jsessionid='
            - 'csrf='
    filter_known:
        cs-host|endswith:
            - '.schneider-electric.com'
            - '.microsoft.com'
            - '.microsoftonline.com'
            - '.office.com'
    condition: selection and not filter_known
falsepositives:
    - Legitimate SaaS or SSO flows that pass session identifiers in URLs
    - Web analytics beacons
level: medium

Known false positives:

  • Users behind NAT, VPN or proxy pools whose source IP changes mid-session
  • Engineers roaming between wired and wireless networks while logged in to the controller web UI

Tuning notes: Restrict dest_ip to Modicon M241/M251/M258/LMC058 controllers and exclude known jump hosts and proxy egress IPs. Raise the src_count threshold or require differing user agents (ua_count>1) to cut noise. Requires decrypted HTTP to expose the Cookie header.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • CVE-2025-13902 Modicon Controller Web Server Script Injection Payload — Exploitation (KQL) · unlock with TL Creds
  • CVE-2025-13902 Modicon Web Session Cookie Replay From Multiple Sources — Post-Exploitation (KQL) · unlock with TL Creds
  • CVE-2025-13902 Browser Callback to Rare External Host After Modicon Controller Web Access — C2/Exfil (KQL) · unlock with TL Creds
  • CVE-2025-13902 Hover-Triggered Script Injection in Modicon Controller Web Request — Exploitation (Sigma) · unlock with TL Creds
  • CVE-2025-13902 Session Token Exfiltration Indicators via Proxy — Post-Exploitation (Sigma) · unlock with TL Creds
  • CVE-2025-13902 Browser Outbound Connection to Non-Standard Port — C2/Exfil (Sigma) · unlock with TL Creds
  • CVE-2025-13902 Modicon Controller Web Server Script Injection Payload — Exploitation (SPL) · unlock with TL Creds
  • CVE-2025-13902 Browser Callback to External Host After Modicon Controller Web Access — C2/Exfil (SPL) · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-5899.

Sample indicators (1 of 21)

  • URL: hxxps://es[.]claroty[.]com/team82/disclosure-dashboard/cve-2025-13902

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

21 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

No exploitation or public PoC is reported (CISA SSVC: exploitation none).

CVE-2025-13902 was reserved on 2025-12-02 and published on 2026-03-10 by Schneider Electric (CNA) under advisory SEVD-2026-069-02, 'Improper Neutralization vulnerability in Multiple Products'. The weakness is CWE-79, Improper Neutralization of Input During Web Page Generation. An authenticated attacker can inject a payload into content served by the controller's embedded web server. The payload executes arbitrary JavaScript in a victim's browser when the victim hovers over a maliciously crafted element. The vendor advisory also warns of possible open redirect, account takeover, or code execution in the user's browser.

Scoring: the advisory and NVD use CVSS v3.1 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The CNA-supplied CVSS v4.0 score is 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N). CISA ADP SSVC v2.0.3 records Exploitation: none, Automatable: no, Technical Impact: partial. Exploitation requires network access to the controller web server, valid credentials, and a user interaction (hover), which limits practical risk. Impact is on the confidentiality and integrity of the victim's browser session (changed scope), not on controller availability.

Affected: Modicon M241 and M251 firmware prior to 5.4.13.12; Modicon M258 and LMC058 firmware, all versions. The vendor lists no fix for M258/LMC058 and offers mitigations only. The Claroty Team82 dashboard entry names Modicon M241/M251/M262, while the CVE record, NVD and the vendor advisory name M241/M251/M258/LMC058. M262 is not listed in the CVE record or in SEVD-2026-069-02. The harness hunt skeleton cited SEVD-2026-069-01, but that advisory covers a different issue (CVE-2025-13901, CWE-404, Machine Expert protocol partial DoS); the correct advisory for this CVE is SEVD-2026-069-02. Reported by Amir Zaltzman of Claroty Team82.

Remediation for M241/M251: install EcoStruxure Machine Expert v2.5.0.1 via the Schneider Electric Software Installer, update the controller to firmware 5.4.13.12 or later, and reboot. Otherwise, or for M258/LMC058, the vendor recommends deploying devices only in protected environments, enforcing user management and strong passwords, deactivating the web server when not needed, using encrypted links and VPNs, segmenting the network and firewalling ports 80/443, and following hardening guide EIO0000004242. No threat actor, campaign, or in-the-wild exploitation is attributed in any reviewed source. No network IOCs exist, so BeaconBeagle correlation does not apply.

MITRE ATT&CK techniques by tactic:

Initial Access

T0819 Exploit Public-Facing Application; T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Lateral Movement

T0859 Valid Accounts

Execution

T1059.007 JavaScript; T1204 User Execution

Collection

T1185 Browser Session Hijacking

Remediation

Patches

  • Modicon M241 and M251: firmware 5.4.13.12 (SEVD-2026-069-02)
  • Modicon M258 and LMC058: no vendor fix listed

Immediate actions

  • Update Modicon M241/M251 firmware to 5.4.13.12 or later via EcoStruxure Machine Expert v2.5.0.1 and reboot the controller
  • Deactivate the controller web server when it is not needed
  • Block access to ports 80 (HTTP) and 443 (HTTPS) on the controllers from unauthorized hosts

Workarounds

  • Use devices only in protected environments
  • Limit web server access with the embedded firewall and network firewalls
  • Avoid browsing the controller web interface from privileged sessions on untrusted workstations

Longer-term hardening

  • Segment control networks behind firewalls and keep controllers off the public internet and untrusted networks
  • Enforce user management and strong passwords on controller accounts
  • Use encrypted communication links and VPNs for remote access
  • Follow Schneider Electric hardening guideline EIO0000004242

Affected and fixed versions

  • Schneider Electric — Modicon M241
    Vulnerable versions: firmware prior to 5.4.13.12
    Fixed in: 5.4.13.12
  • Schneider Electric — Modicon M251
    Vulnerable versions: firmware prior to 5.4.13.12
    Fixed in: 5.4.13.12
  • Schneider Electric — Modicon M258
    Vulnerable versions: all versions
  • Schneider Electric — Modicon LMC058
    Vulnerable versions: all versions

Timeline

Last updated · revalidated 1× · latest source

  • CVE-2025-13902 reserved by Schneider Electric (CNA).
  • Sibling advisory SEVD-2026-069-01 (CVE-2025-13901, Machine Expert protocol partial DoS) is released alongside; the Claroty dashboard links to it for this CVE, although it covers a different flaw.
  • NVD publishes the record at 18:17 UTC with the CNA CVSS v4.0 score 5.1 and references tagged Vendor Advisory, Mitigation and Patch; the CVE record itself was last updated 18:19 UTC the same day.
  • CISA ADP (Vulnrichment, SSVC v2.0.3) timestamps its assessment at 2026-03-10T18:17:03Z: Exploitation none, Automatable no, Technical Impact partial.
  • CVE-2025-13902 published in the CVE Program and NVD; CISA ADP records SSVC exploitation none, automatable no, technical impact partial.
  • Schneider Electric publishes SEVD-2026-069-02 (initial release) with firmware 5.4.13.12 for M241/M251 and mitigations for M258/LMC058.
  • CISA releases ICS advisory ICSA-26-078-02 crediting Amir Zaltzman of Claroty Team82 and stating no known public exploitation has been reported.
  • SEVD-2026-069-02 version 1.1.0 updates the acknowledgements section (credit to Amir Zaltzman, Claroty Team82).
  • NVD marks the record Analyzed (last modified), adding CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4) and CPE configurations.
  • Tenable OT Security publishes plugin 505937 to detect affected Modicon controllers; the plugin notes no known exploits (VPR 2.3).

Update history

Sources cited

Other reports on CVE-2025-13901

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats