CVE-2025-13901 - Schneider Electric Modicon M241/M251/M262 Machine Expert Protocol Partial Denial of Service (CWE-404)

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5903 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2025-13901 Modicon Controller Rejected/Reset Connection Surge — Availability Impact

Detects a surge (20+ in 5 minutes) of rejected, unanswered or reset connections to a Modicon M241/M251/M262 Machine Expert protocol port. When CVE-2025-13901 occupies the controller's active communication channels, new legitimate engineering/communication sessions fail, which appears as REJ/S0/RSTO connection states. Observable symptom of partial denial of service (T0814 / T0826).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1499.002, T0814, T0826
• Data sources: zeek_conn (index=ot_network sourcetype=bro:conn:json), firewall_traffic
• Severity: medium
• Confidence: medium

Splunk SPL

index=ot_network sourcetype="bro:conn:json" id.resp_p=1105 proto=tcp conn_state IN ("REJ","S0","RSTO","RSTR","RSTOS0") | bin _time span=5m | stats count AS failed_conns dc(id.orig_h) AS distinct_sources values(id.orig_h) AS sources by _time, id.resp_h | where failed_conns>=20 | eval cve="CVE-2025-13901", tl_id="TL-2026-5903", symptom="Machine Expert protocol channels occupied" | table _time id.resp_h failed_conns distinct_sources sources cve tl_id symptom

Microsoft KQL

CommonSecurityLog | where TimeGenerated > ago(24h) | where DestinationPort == 1105 and Protocol =~ "TCP" | where DeviceAction in~ ("deny", "drop", "reset-client", "reset-server", "reset-both", "blocked") | summarize FailedConns = count(), DistinctSources = dcount(SourceIP) by DestinationIP, bin(TimeGenerated, 5m) | where FailedConns >= 20 | extend CVE = "CVE-2025-13901", ThreatId = "TL-2026-5903" | project TimeGenerated, DestinationIP, FailedConns, DistinctSources, CVE, ThreatId

Sigma

title: CVE-2025-13901 Rejected or Reset Connections to Modicon Machine Expert Port
id: 2b9e6f10-8d4c-4a3b-b7e5-1f0c9a7d2b02
status: experimental
description: Detects denied, dropped or reset connections to the Machine Expert protocol port (assumed 1105/tcp) of Modicon controllers. A surge of these events (20+ per 5 minutes per controller, applied in the SIEM) can indicate communication channels occupied by CVE-2025-13901 exploitation.
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-01
    - https://nvd.nist.gov/vuln/detail/cve-2025-13901
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.impact
    - attack.t1499.002
    - attack.t0814
    - attack.t0826
    - cve.2025.13901
logsource:
    category: firewall
detection:
    selection:
        dst_port: 1105
        action:
            - deny
            - drop
            - reset
    condition: selection
falsepositives:
    - Controller reboot or firmware update (required after patching)
    - Intentional firewall policy blocking of PLC access
level: medium

Known false positives:

• Controller reboot or firmware update causes transient refused connections
• Planned maintenance or network outage on the control network

Tuning notes: Correlate with SPL-001/KQL-001 burst alerts and with change-management windows (firmware updates to 5.4.13.12 / 5.4.10.12 require reboots). Adjust the 20-event threshold per controller baseline.

• 🔒 Internet or Untrusted-Source Access to Modicon Machine Expert Protocol Port — CVE-2025-13901 Exposure · unlock with TL Creds
• 🔒 Engineering Workstation Failed Connections to Modicon Machine Expert Port — CVE-2025-13901 Impact Symptom · unlock with TL Creds
• 🔒 Single Source Sweeping Multiple Modicon Controllers on Machine Expert Ports — Lateral Discovery · unlock with TL Creds
• 🔒 CVE-2025-13901 Allowed Firewall Traffic to Modicon Machine Expert Port from Non-Allowlisted Source · unlock with TL Creds
• 🔒 Scripting or Scanning Tool Connecting to Modicon Machine Expert Port — Custom Exploit Client Indicator · unlock with TL Creds
• 🔒 Schneider Machine Expert UDP Discovery Traffic from Non-Engineering Host — Controller Enumeration · unlock with TL Creds
• 🔒 CVE-2025-13901 Modicon Machine Expert Protocol Connection Burst from Non-Engineering Host — Exploitation · unlock with TL Creds
• 🔒 Modicon Machine Expert Port Sweep Across Multiple PLCs — CVE-2025-13901 Reconnaissance · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5903.

Sample indicators (1 of 11)

• URL: hxxps://www[.]cisa[.]gov/news-events/ics-advisories/icsa-26-078-01

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.

Technical analysis

Fixed firmware is available via EcoStruxure Machine Expert v2.5.0.1 (advisory SEVD-2026-069-01); no public exploitation is reported.

CVE-2025-13901 affects the embedded Machine Expert protocol service on Schneider Electric Modicon M241, M251 and M262 programmable logic controllers. The weakness is classified as CWE-404 (Improper Resource Shutdown or Release). Per the CVE record, NVD and the vendor advisory, an unauthenticated attacker who can reach the controller over the network can send a malicious payload that occupies the active communication channels of the Machine Expert protocol, producing a partial denial of service. The NVD CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3 Medium), so the impact is limited to availability; no confidentiality or integrity impact is scored. Schneider Electric (CNA) also assigned CVSS v4.0 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N.

Affected firmware: Modicon M241 and M251 versions prior to 5.4.13.12, and Modicon M262 versions prior to 5.4.10.12. The hardware CPEs are not marked vulnerable; the flaw is in firmware. The issue was reported to Schneider Electric by Amir Zaltzman of Claroty Team82. Schneider published advisory SEVD-2026-069-01 on 2026-03-10 (the same day NVD published the CVE), and CISA republished it as ICSA-26-078-01 on 2026-03-19. CISA lists the affected sectors as Commercial Facilities, Critical Manufacturing and Energy, with worldwide deployment.

The sources do not describe the exploit mechanics beyond the above, do not list protocol port numbers, and do not mention a public proof-of-concept. CISA states it has no reports of public exploitation. Because the vulnerable service is a controller engineering/communication protocol, practical exposure depends on whether the controllers are reachable from untrusted or flat networks; defenders should treat any Machine Expert protocol exposure beyond the engineering network as in scope. No network or file IOCs are published for this vulnerability; the IOC list below records the identifying artifacts (products, fixed versions, advisory documents, tooling) that defenders can use for asset inventory and patch tracking, not attacker infrastructure. No BeaconBeagle correlation applies because there are no network IOCs.

MITRE ATT&CK techniques by tactic:

Inhibit Response Function

T0814 Denial of Service

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1499.002 Service Exhaustion Flood

Remediation

Patches

• Install EcoStruxure Machine Expert v2.5.0.1 on the engineering workstation using Schneider Electric Software Installer
• Update M241 and M251 firmware to 5.4.13.12 or later and M262 firmware to 5.4.10.12 or later, then reboot the controller

Immediate actions

• Inventory all Modicon M241, M251 and M262 controllers and their firmware versions
• Ensure controllers are not reachable from the public internet or untrusted networks
• Filter ports and IP addresses with the controller's embedded firewall

Workarounds

• Keep controllers in a protected environment with network filtering if patching is not yet possible

Longer-term hardening

• Use encrypted communication links and VPNs for remote access
• Apply Schneider Electric hardening guidance in the Recommended Cybersecurity Guidelines (EIO0000004242)
• Segment PLC and control networks from IT networks

Affected and fixed versions

• Schneider Electric — Modicon M241
  Vulnerable versions: prior to 5.4.13.12
  Fixed in: 5.4.13.12 (EcoStruxure Machine Expert v2.5.0.1)
• Schneider Electric — Modicon M251
  Vulnerable versions: prior to 5.4.13.12
  Fixed in: 5.4.13.12 (EcoStruxure Machine Expert v2.5.0.1)
• Schneider Electric — Modicon M262
  Vulnerable versions: prior to 5.4.10.12
  Fixed in: 5.4.10.12 (EcoStruxure Machine Expert v2.5.0.1)

Timeline

• 2025-12-02 CVE-2025-13901 reserved by Schneider Electric (CNA).
• 2026-03-10 Fixed firmware 5.4.13.12 (M241/M251) and 5.4.10.12 (M262) made available through EcoStruxure Machine Expert v2.5.0.1 via Schneider Electric Software Installer; controller reboot required after update.
• 2026-03-10 NVD publishes CVE-2025-13901 with CVSS v3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and vendor CVSS v4.0 6.9.
• 2026-03-10 Schneider Electric publishes security notice SEVD-2026-069-01 crediting Claroty Team82; fixed firmware delivered with EcoStruxure Machine Expert v2.5.0.1.
• 2026-03-19 CISA advisory lists interim mitigations for unpatched controllers: keep controllers off the internet and untrusted networks, filter ports/IPs with the embedded firewall, use encrypted links and VPNs, and follow EIO0000004242 hardening guidance.
• 2026-03-19 CISA republishes the vendor advisory as ICSA-26-078-01 (Revision 1, initial republication of Schneider Electric CPCERT SEVD-2026-069-01), stating no reports of public exploitation.
• 2026-03-23 Claroty Team82 lists CVE-2025-13901 on its vulnerability disclosure dashboard (Medium, CVSS v3 5.3, CWE-404); secondary sources date the related disclosure 2026-03-23.
• 2026-06-23 NVD record last modified; status Analyzed with firmware CPEs prior to 5.4.13.12 (M241/M251) and 5.4.10.12 (M262) marked vulnerable.

Sources cited

• CISA ICS Advisory ICSA-26-078-01 - Schneider Electric Modicon M241, M251, and M262 CISA · Government advisory · 2026-03-19
• NVD - CVE-2025-13901 NVD (NIST) · Advisory · 2026-03-10
• Claroty Team82 Disclosure Dashboard - CVE-2025-13901 es.claroty.com · Research
• Claroty Team82 Disclosure Dashboard - CVE-2025-13901 (blog mirror) blog.claroty.com · Research
• Schneider Electric Security Notice SEVD-2026-069-01 download.se.com · Vendor report · 2026-03-10
• VulDB - Schneider Electric Modicon M241/M251/M262 prior 5.4.13.12 Machine Expert Protocol denial of service vuldb.com · Research
• Tenable OT - Schneider Electric Modicon M241, M251, and M262 Improper Resource Shutdown or Release (CVE-2025-13901) Tenable · Research
• GCVE - CVE-2025-13901 db.gcve.eu · Research

More in ics scada

• CVE-2026-25037: OS Command Injection in Copeland XWEB Pro (<=1.12.1) Enabling Authenticated RCE via Crafted LCD State
• CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Code Injection via Insufficient Input Validation (Pre-Authentication)
• CVE-2026-21657 - Johnson Controls Frick Controls Quantum HD Insufficient Input Validation (Pre-Authentication Code Injection)
• CVE-2026-21658: Pre-Authentication Input Validation / Code Injection Flaw in Johnson Controls Frick Controls Quantum HD (10.22 and earlier, legacy through 11)
• CVE-2026-21659 — Johnson Controls Frick Controls Quantum HD unauthenticated path traversal / local file inclusion leading to arbitrary code execution

Related coverage of this activity

• Schneider Modicon DoS
• Modicon M241 DoS flaw

Other reports on CVE-2025-13901

• CVE-2025-13902: Authenticated Cross-Site Scripting (CWE-79) in Schneider Electric Modicon M241/M251/M258/LMC058 Controller Web Server (Claroty also lists M262)
• CVE-2025-13902: Stored/Reflected XSS (CWE-79) in Schneider Electric Modicon M241/M251/M258/LMC058 Controllers Web Server

Previous and next in ics scada

• Copeland XWEB PRO refrigeration controllers abused for spam botnet, proxy/tunnel traffic and default-credential setpoint tampering (CVE-2026-25085 suspected entry point) Previous report