# CVE-2025-13902: Authenticated Cross-Site Scripting (CWE-79) in Schneider Electric Modicon M241/M251/M258/LMC058 Controller Web Server (Claroty also lists M262)

> CVE-2025-13902 is a CWE-79 cross-site scripting flaw in the embedded web server of Schneider Electric Modicon M241/M251 controllers (fixed in firmware 5.4.13.12) and M258/LMC058 (all versions, no fix listed). An authenticated attacker can plant a payload that runs arbitrary JavaScript in a victim's browser when the victim hovers over a crafted element. No exploitation or public PoC is reported (CISA SSVC: exploitation none).

- **Published:** 2026-11-12T22:45:06Z
- **Last reviewed:** 2026-11-13T01:41:42.590Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5899
- **ID:** TL-2026-5899
- **Severity:** MEDIUM (CVSS 5.4)
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (1 shown free below)
- **CVEs:** CVE-2025-13902, CVE-2025-13901

## Description

CVE-2025-13902 was reserved on 2025-12-02 and published on 2026-03-10 by Schneider Electric (CNA) under advisory SEVD-2026-069-02, 'Improper Neutralization vulnerability in Multiple Products'. The weakness is CWE-79, Improper Neutralization of Input During Web Page Generation. An authenticated attacker can inject a payload into content served by the controller's embedded web server. The payload executes arbitrary JavaScript in a victim's browser when the victim hovers over a maliciously crafted element. The vendor advisory also warns of possible open redirect, account takeover, or code execution in the user's browser.

Scoring: the advisory and NVD use CVSS v3.1 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The CNA-supplied CVSS v4.0 score is 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N). CISA ADP SSVC v2.0.3 records Exploitation: none, Automatable: no, Technical Impact: partial. Exploitation requires network access to the controller web server, valid credentials, and a user interaction (hover), which limits practical risk. Impact is on the confidentiality and integrity of the victim's browser session (changed scope), not on controller availability.

Affected: Modicon M241 and M251 firmware prior to 5.4.13.12; Modicon M258 and LMC058 firmware, all versions. The vendor lists no fix for M258/LMC058 and offers mitigations only. The Claroty Team82 dashboard entry names Modicon M241/M251/M262, while the CVE record, NVD and the vendor advisory name M241/M251/M258/LMC058. M262 is not listed in the CVE record or in SEVD-2026-069-02. The harness hunt skeleton cited SEVD-2026-069-01, but that advisory covers a different issue (CVE-2025-13901, CWE-404, Machine Expert protocol partial DoS); the correct advisory for this CVE is SEVD-2026-069-02. Reported by Amir Zaltzman of Claroty Team82.

Remediation for M241/M251: install EcoStruxure Machine Expert v2.5.0.1 via the Schneider Electric Software Installer, update the controller to firmware 5.4.13.12 or later, and reboot. Otherwise, or for M258/LMC058, the vendor recommends deploying devices only in protected environments, enforcing user management and strong passwords, deactivating the web server when not needed, using encrypted links and VPNs, segmenting the network and firewalling ports 80/443, and following hardening guide EIO0000004242. No threat actor, campaign, or in-the-wild exploitation is attributed in any reviewed source. No network IOCs exist, so BeaconBeagle correlation does not apply.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1204 User Execution
- T1059.007 JavaScript
- T1185 Browser Session Hijacking
- T0819 Exploit Public-Facing Application
- T0859 Valid Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2025-13902 Modicon Web Session Cookie Replay From Multiple Sources — Post-Exploitation (SPL)** (`TL-2026-5899-SPL-002`)

Detects one controller web session cookie presented from more than one source IP within 24 hours. A script injected through CVE-2025-13902 (CWE-79) runs in the victim's browser session and can lead to session theft or hijack (vendor-noted account takeover); replaying the stolen cookie from the attacker's host shows up as a single session hash with several client IPs. Cookies are hashed with md5 so no raw token is stored in results.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1185, T1539, T1078
- **Data sources:** splunk_stream_http, network_traffic, web_proxy
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

```spl
earliest=-24h index=network sourcetype="stream:http" dest_port IN (80,443) cookie=* | eval session_hash=md5(cookie) | stats count dc(src_ip) as src_count values(src_ip) as src_ips dc(http_user_agent) as ua_count values(http_user_agent) as user_agents values(http_method) as methods min(_time) as first_seen max(_time) as last_seen by dest_ip session_hash | where src_count>1 | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | table first_seen last_seen dest_ip session_hash src_count src_ips ua_count user_agents methods count
```

### Microsoft KQL

```kql
CommonSecurityLog | where TimeGenerated > ago(24h) | where DestinationPort in (80, 443) | where isnotempty(RequestCookies) | extend SessionHash = hash_sha256(RequestCookies) | summarize SourceCount = dcount(SourceIP), SourceIPs = make_set(SourceIP, 10), AgentCount = dcount(RequestClientApplication), Requests = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DestinationIP, SessionHash | where SourceCount > 1
```

### Sigma

```yaml
title: CVE-2025-13902 Session Token Exfiltration Indicators in Outbound Proxy Request
id: 2f9b84d6-61a3-4c0e-b7d5-8e3a0c4f7d12
status: experimental
description: Detects outbound proxy requests carrying cookie or session-token parameters or document.cookie references, consistent with script injected through CVE-2025-13902 (CWE-79, Schneider Electric Modicon controller web server) stealing a victim's session for hijack or account takeover.
references:
    - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-02.pdf
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.collection
    - attack.t1185
    - attack.credential_access
    - attack.t1539
    - attack.initial_access
    - attack.t1078
    - cve.2025.13902
logsource:
    category: proxy
detection:
    selection:
        cs-uri-query|contains:
            - 'document.cookie'
            - 'cookie='
            - 'sessionid='
            - 'session_id='
            - 'jsessionid='
            - 'csrf='
    filter_known:
        cs-host|endswith:
            - '.schneider-electric.com'
            - '.microsoft.com'
            - '.microsoftonline.com'
            - '.office.com'
    condition: selection and not filter_known
falsepositives:
    - Legitimate SaaS or SSO flows that pass session identifiers in URLs
    - Web analytics beacons
level: medium
```

**Known false positives:**

- Users behind NAT, VPN or proxy pools whose source IP changes mid-session
- Engineers roaming between wired and wireless networks while logged in to the controller web UI

**Tuning notes:** Restrict dest_ip to Modicon M241/M251/M258/LMC058 controllers and exclude known jump hosts and proxy egress IPs. Raise the src_count threshold or require differing user agents (ua_count>1) to cut noise. Requires decrypted HTTP to expose the Cookie header.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2025-13902 Modicon Controller Web Server Script Injection Payload — Exploitation (KQL) (locked: unlock with TL Creds)
- CVE-2025-13902 Modicon Web Session Cookie Replay From Multiple Sources — Post-Exploitation (KQL) (locked: unlock with TL Creds)
- CVE-2025-13902 Browser Callback to Rare External Host After Modicon Controller Web Access — C2/Exfil (KQL) (locked: unlock with TL Creds)
- CVE-2025-13902 Hover-Triggered Script Injection in Modicon Controller Web Request — Exploitation (Sigma) (locked: unlock with TL Creds)
- CVE-2025-13902 Session Token Exfiltration Indicators via Proxy — Post-Exploitation (Sigma) (locked: unlock with TL Creds)
- CVE-2025-13902 Browser Outbound Connection to Non-Standard Port — C2/Exfil (Sigma) (locked: unlock with TL Creds)
- CVE-2025-13902 Modicon Controller Web Server Script Injection Payload — Exploitation (SPL) (locked: unlock with TL Creds)
- CVE-2025-13902 Browser Callback to External Host After Modicon Controller Web Access — C2/Exfil (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 21)

Defanged, TLP:CLEAR.

- URL: `hxxps://es[.]claroty[.]com/team82/disclosure-dashboard/cve-2025-13902`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2025-13902](https://es.claroty.com/team82/disclosure-dashboard/cve-2025-13902)
- [Schneider Electric SEVD-2026-069-02 - Improper Neutralization vulnerability in Multiple Products](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-02.pdf)
- [NVD - CVE-2025-13902](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-13902)
- [CVE Record - CVE-2025-13902 (CVE Program)](https://cveawg.mitre.org/api/cve/CVE-2025-13902)
- [GCVE - SEVD-2026-069-02 (CSAF summary)](https://db.gcve.eu/vuln/sevd-2026-069-02)
- [GCVE - SEVD-2026-069-01 (related Modicon advisory, CVE-2025-13901, not this CVE)](https://db.gcve.eu/vuln/sevd-2026-069-01)
- [Schneider Electric SEVD-2026-069-01 (linked from Claroty page; covers CVE-2025-13901)](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-01.pdf)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5899