Schneider Electric Modicon Controllers M241 / M251 vulnerabilities

3 vulnerabilities

Known vulnerabilities in Schneider Electric Modicon Controllers M241 / M251, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.7CVE-2025-2875schneider electricmodicon controllers m241 / m251+1
EPSS score
0.44%
CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker manipulates controller’s webserver URL to access resources.9.8CVE-2024-11737schneider electricmodicon controllers m241 / m251+1
EPSS score
0.64%
CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidentiality, integrity of the controller when an unauthenticated crafted Modbus packet is sent to the device.6.1CVE-2024-6528schneider electricmodicon controllers m241 / m251+2
EPSS score
0.26%
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulnerability leading to a cross-site scripting condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a page containing the injected payload.