Summary
Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251, M258 / LMC058 and M262 product(s).
The Modicon Controllers M241 / M251 / M258 / M262 and Modicon Motion Controller LMC058 Programmable Logic Controllers for performance-demanding applications. Failure to apply the remediation provided below may risk a Cross Site Scripting or an open redirect attack which could result in an account takeover scenario or the execution of code in the user browser.October 2025 Update: A remediation is now available for Modicon Controllers M258 / LMC058
Vulnerabilities 1
-
Medium 5.4
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that …
Revision history
-
#3.0.0
A remediation is now available for Modicon Controllers M258 / LMC058.
-
#2.0.0
A remediation is now available for Modicon Controllers M262 and M241 / M251.
-
#1.0.0
Original Release
References
-
Modicon Controllers M241/ M251, M258 / LMC058 and M262 - SEVD-2024-191-04 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-04.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/