Threat video1:00
CVE-2025-13901 Modicon M241/M251/M262: Analysis & Hunting
Unauthenticated packets tie up Modicon M241/M251/M262 channels; no exploit is reported. 9 detection rules, 11 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2025-13901 - Schneider Electric Modicon M241/M251/M262 Machine… →
Chapters
- 0:00The hookController flaw, now patched.
- 0:04The storyFixed firmware available in March.
- 0:11Attack pathExposed controllers are in scope.
- 0:23AttributionNo threat actor: this was defensive research.
- 0:28Indicators of compromise3 indicators to hunt: 1 URL and 2 file names.
- 0:34MITRE ATT&CK techniques3 ATT&CK techniques, from initial access to inhibit response function.
- 0:39Remediation3 steps now: Inventory all Modicon M241, M251 and M262 controllers.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Controller flaw, now patched.
0:05Fixed firmware available in March.
0:07Update, then reboot the controller.
0:11Exposed controllers are in scope.
0:13Older firmware is affected.
0:15Traffic occupies active communication channels.
0:18Result: partial denial of service.
0:24No threat actor: this was defensive research.
0:283 indicators to hunt: 1 URL and 2 file names.
0:343 ATT&CK techniques, from initial access to inhibit response function.
0:403 steps now: Inventory all Modicon M241, M251 and M262 controllers.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.