Summary
Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251 / M258 / LMC058 products.
The Modicon Controllers M241/M251/M258 https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/ and Modicon LMC058 https://www.se.com/ww/en/product-range/7744-modicon-lmc058/ products are Programmable Logic Controllers for performance-demanding applications.
Failure to apply remediation/mitigations provided below may risk an unauthenticated read of arbitrary files which could result in loss of confidential data stored on the controller.
July 2025 Update: A remediation is now available within EcoStruxure™ Machine Expert v2.3 used to update the Modicon Controlers firmware.
Vulnerabilities 1
-
High 7.5
CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss o…
Revision history
-
#3.0.0
A remediation is now available for Modicon M258 / LMC058
-
#2.0.0
A remediation for M241/M251 is now available within EcoStruxure™ Machine Expert v2.3
-
#1.0.0
Original Release
References
-
Modicon Controllers M241/M251/M258/LMC058 - SEVD-2025-133-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-133-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-133-01.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/