Summary
Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251, and M262 products.
The Modicon Controllers M241 / M251 / M262 are Programmable Logic Controllers for performancedemanding applications.
Failure to apply the remediation provided below may risk Denial of Service attack which could result in loss of
availability of the controller
Vulnerabilities 1
-
Medium 6.9
CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machin…
Revision history
-
#2
Initial CISA Republication of Schneider Electric CPCERT SEVD-2026-069-01 advisory
-
#1
Original Release
References
-
Improper Resource Shutdown or Release vulnerability in Multiple Products - SEVD-2026-069-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-01.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/ww/en/download/document/7EN52-0390
-
ICS Advisory ICSA-26-078-01 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-01
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b