Skip to content
OpenAdvisories
High ICSA-25-140-08 1 CVE

Schneider Electric Modicon Controllers (Update B)

Published May 13, 2025 · Updated Oct 14, 2025 · Revision 3

Vendor: Schneider Electric Product: EcoStruxure Automation Expert - Motion Product: EcoStruxure Machine Expert Product: Modicon Controllers LMC058 Product: Modicon Controllers M241 Product: Modicon Controllers M251 Product: Modicon Controllers M258

Summary

Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251 / M258 / LMC058 products.

The Modicon Controllers M241/M251/M258 https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/ and Modicon LMC058 https://www.se.com/ww/en/product-range/7744-modicon-lmc058/ products are Programmable Logic Controllers for performance-demanding applications.

Failure to apply remediation/mitigations provided below may risk an unauthenticated read of arbitrary files which could result in loss of confidential data stored on the controller.

July 2025 Update: A remediation is now available within EcoStruxure™ Machine Expert v2.3 used to update the Modicon Controlers firmware.

Vulnerabilities 1

Revision history

  1. #3.0.0

    A remediation is now available for Modicon M258 / LMC058

  2. #2.0.0

    A remediation for M241/M251 is now available within EcoStruxure™ Machine Expert v2.3

  3. #1.0.0

    Original Release

References