Schneider Electric Modicon Controllers M258 / Lmc058 vulnerabilities

5 vulnerabilities

Known vulnerabilities in Schneider Electric Modicon Controllers M258 / Lmc058, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.7CVE-2025-2875schneider electricmodicon controllers m241 / m251+1
EPSS score
0.44%
CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker manipulates controller’s webserver URL to access resources.5.4CVE-2025-3905schneider electricmodicon controllers m241/m251+1
EPSS score
0.30%
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting PLC system variables that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser.7.1CVE-2025-3116schneider electricmodicon controllers m241/m251+1
EPSS score
0.46%
CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends special malformed HTTPS request containing improper formatted body data to the controller.9.8CVE-2024-11737schneider electricmodicon controllers m241 / m251+1
EPSS score
0.64%
CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidentiality, integrity of the controller when an unauthenticated crafted Modbus packet is sent to the device.6.1CVE-2024-6528schneider electricmodicon controllers m241 / m251+2
EPSS score
0.26%
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulnerability leading to a cross-site scripting condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a page containing the injected payload.