# CVE-2025-13901 - Schneider Electric Modicon M241/M251/M262 Machine Expert Protocol Partial Denial of Service (CWE-404)

> CVE-2025-13901 is an improper resource shutdown or release flaw (CWE-404) in the Machine Expert protocol of Schneider Electric Modicon M241, M251 and M262 controllers. An unauthenticated network attacker can send a malicious payload that occupies active communication channels, causing a partial denial of service. Fixed firmware is available via EcoStruxure Machine Expert v2.5.0.1 (advisory SEVD-2026-069-01); no public exploitation is reported.

- **Published:** 2026-11-12T23:19:03Z
- **Last reviewed:** 2026-11-12T23:19:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5903
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5903.png
- **ID:** TL-2026-5903
- **Severity:** MEDIUM (CVSS 5.3)
- **Category:** ICS_SCADA
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 11 (1 shown free below)
- **CVEs:** CVE-2025-13901

## Description

CVE-2025-13901 affects the embedded Machine Expert protocol service on Schneider Electric Modicon M241, M251 and M262 programmable logic controllers. The weakness is classified as CWE-404 (Improper Resource Shutdown or Release). Per the CVE record, NVD and the vendor advisory, an unauthenticated attacker who can reach the controller over the network can send a malicious payload that occupies the active communication channels of the Machine Expert protocol, producing a partial denial of service. The NVD CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3 Medium), so the impact is limited to availability; no confidentiality or integrity impact is scored. Schneider Electric (CNA) also assigned CVSS v4.0 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N.

Affected firmware: Modicon M241 and M251 versions prior to 5.4.13.12, and Modicon M262 versions prior to 5.4.10.12. The hardware CPEs are not marked vulnerable; the flaw is in firmware. The issue was reported to Schneider Electric by Amir Zaltzman of Claroty Team82. Schneider published advisory SEVD-2026-069-01 on 2026-03-10 (the same day NVD published the CVE), and CISA republished it as ICSA-26-078-01 on 2026-03-19. CISA lists the affected sectors as Commercial Facilities, Critical Manufacturing and Energy, with worldwide deployment.

The sources do not describe the exploit mechanics beyond the above, do not list protocol port numbers, and do not mention a public proof-of-concept. CISA states it has no reports of public exploitation. Because the vulnerable service is a controller engineering/communication protocol, practical exposure depends on whether the controllers are reachable from untrusted or flat networks; defenders should treat any Machine Expert protocol exposure beyond the engineering network as in scope. No network or file IOCs are published for this vulnerability; the IOC list below records the identifying artifacts (products, fixed versions, advisory documents, tooling) that defenders can use for asset inventory and patch tracking, not attacker infrastructure. No BeaconBeagle correlation applies because there are no network IOCs.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1499.002 Service Exhaustion Flood
- T0814 Denial of Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2025-13901 Modicon Controller Rejected/Reset Connection Surge — Availability Impact** (`TL-2026-5903-SPL-002`)

Detects a surge (20+ in 5 minutes) of rejected, unanswered or reset connections to a Modicon M241/M251/M262 Machine Expert protocol port. When CVE-2025-13901 occupies the controller's active communication channels, new legitimate engineering/communication sessions fail, which appears as REJ/S0/RSTO connection states. Observable symptom of partial denial of service (T0814 / T0826).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1499.002, T0814, T0826
- **Data sources:** zeek_conn (index=ot_network sourcetype=bro:conn:json), firewall_traffic
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

```spl
index=ot_network sourcetype="bro:conn:json" id.resp_p=1105 proto=tcp conn_state IN ("REJ","S0","RSTO","RSTR","RSTOS0") | bin _time span=5m | stats count AS failed_conns dc(id.orig_h) AS distinct_sources values(id.orig_h) AS sources by _time, id.resp_h | where failed_conns>=20 | eval cve="CVE-2025-13901", tl_id="TL-2026-5903", symptom="Machine Expert protocol channels occupied" | table _time id.resp_h failed_conns distinct_sources sources cve tl_id symptom
```

### Microsoft KQL

```kql
CommonSecurityLog | where TimeGenerated > ago(24h) | where DestinationPort == 1105 and Protocol =~ "TCP" | where DeviceAction in~ ("deny", "drop", "reset-client", "reset-server", "reset-both", "blocked") | summarize FailedConns = count(), DistinctSources = dcount(SourceIP) by DestinationIP, bin(TimeGenerated, 5m) | where FailedConns >= 20 | extend CVE = "CVE-2025-13901", ThreatId = "TL-2026-5903" | project TimeGenerated, DestinationIP, FailedConns, DistinctSources, CVE, ThreatId
```

### Sigma

```yaml
title: CVE-2025-13901 Rejected or Reset Connections to Modicon Machine Expert Port
id: 2b9e6f10-8d4c-4a3b-b7e5-1f0c9a7d2b02
status: experimental
description: Detects denied, dropped or reset connections to the Machine Expert protocol port (assumed 1105/tcp) of Modicon controllers. A surge of these events (20+ per 5 minutes per controller, applied in the SIEM) can indicate communication channels occupied by CVE-2025-13901 exploitation.
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-01
    - https://nvd.nist.gov/vuln/detail/cve-2025-13901
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.impact
    - attack.t1499.002
    - attack.t0814
    - attack.t0826
    - cve.2025.13901
logsource:
    category: firewall
detection:
    selection:
        dst_port: 1105
        action:
            - deny
            - drop
            - reset
    condition: selection
falsepositives:
    - Controller reboot or firmware update (required after patching)
    - Intentional firewall policy blocking of PLC access
level: medium
```

**Known false positives:**

- Controller reboot or firmware update causes transient refused connections
- Planned maintenance or network outage on the control network

**Tuning notes:** Correlate with SPL-001/KQL-001 burst alerts and with change-management windows (firmware updates to 5.4.13.12 / 5.4.10.12 require reboots). Adjust the 20-event threshold per controller baseline.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Internet or Untrusted-Source Access to Modicon Machine Expert Protocol Port — CVE-2025-13901 Exposure (locked: unlock with TL Creds)
- Engineering Workstation Failed Connections to Modicon Machine Expert Port — CVE-2025-13901 Impact Symptom (locked: unlock with TL Creds)
- Single Source Sweeping Multiple Modicon Controllers on Machine Expert Ports — Lateral Discovery (locked: unlock with TL Creds)
- CVE-2025-13901 Allowed Firewall Traffic to Modicon Machine Expert Port from Non-Allowlisted Source (locked: unlock with TL Creds)
- Scripting or Scanning Tool Connecting to Modicon Machine Expert Port — Custom Exploit Client Indicator (locked: unlock with TL Creds)
- Schneider Machine Expert UDP Discovery Traffic from Non-Engineering Host — Controller Enumeration (locked: unlock with TL Creds)
- CVE-2025-13901 Modicon Machine Expert Protocol Connection Burst from Non-Engineering Host — Exploitation (locked: unlock with TL Creds)
- Modicon Machine Expert Port Sweep Across Multiple PLCs — CVE-2025-13901 Reconnaissance (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 11)

Defanged, TLP:CLEAR.

- URL: `hxxps://www[.]cisa[.]gov/news-events/ics-advisories/icsa-26-078-01`

Full set of 11 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2025-13901](https://es.claroty.com/team82/disclosure-dashboard/cve-2025-13901)
- [Claroty Team82 Disclosure Dashboard - CVE-2025-13901 (blog mirror)](https://blog.claroty.com/team82/disclosure-dashboard/cve-2025-13901)
- [Schneider Electric Security Notice SEVD-2026-069-01](https://download.se.com/files?p_Doc_Ref=SEVD-2026-069-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-01.pdf)
- [CISA ICS Advisory ICSA-26-078-01 - Schneider Electric Modicon M241, M251, and M262](https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-01)
- [NVD - CVE-2025-13901](https://nvd.nist.gov/vuln/detail/cve-2025-13901)
- [VulDB - Schneider Electric Modicon M241/M251/M262 prior 5.4.13.12 Machine Expert Protocol denial of service](https://vuldb.com/vuln/350072)
- [Tenable OT - Schneider Electric Modicon M241, M251, and M262 Improper Resource Shutdown or Release (CVE-2025-13901)](https://www.tenable.com/plugins/ot/505515)
- [GCVE - CVE-2025-13901](https://db.gcve.eu/vuln/cve-2025-13901)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5903