Description
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | Modicon Controllers M241/M251 | Versions prior to 5.4.13.12 | — |
| Schneider Electric | Modicon Controllers M258/LMC058 | All versions | — |
Advisories 2
- SEVD-2026-069-02 Improper Neutralization vulnerability in Multiple Products Schneider Electric CPCERT · Mar 31, 2026
- ICSA-26-078-02 Schneider Electric Modicon Controllers M241, M251, M258, and LMC058 CISA ICS & IT advisories · Mar 19, 2026