Vulnerability in Schneider Electric Modicon M241/m251
CVE-2025-13901
CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels.
EPSS: 0.005 (36.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Schneider Electric Modicon M241/m251 — versions Versions prior to 5.4.13.12
- Schneider Electric Modicon M262 — versions Versions prior to 5.4.10.12
- Schneider-electric Modicon_m241
- Schneider-electric Modicon_m241_firmware
- Schneider-electric Modicon_m251
- Schneider-electric Modicon_m251_firmware
- Schneider-electric Modicon_m262
- Schneider-electric Modicon_m262_firmware
Weakness classification (CWE)
References
- cybersecurity@se.com (Patch, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-13901?
- CVE-2025-13901 is a medium-severity vulnerability in Schneider Electric Modicon M241/m251, classified under Improper Resource Shutdown or Release. CVSS score: 5.3/10. Published 2026-03-10.
- How severe is CVE-2025-13901?
- Medium severity. CVSS v3 base score is 5.3 out of 10.