Description
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability
exists impacting configuration file paths that could cause an unvalidated data injected by authenticated
malicious user leading to modify or read data in a victim’s browser.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | Modicon Controllers M241/M251 | Versions prior to 5.3.12.51 | — |
| Schneider Electric | Modicon Controllers M262 | Versions prior to 5.3.9.18 | — |
Advisories 2
- ICSA-25-175-03 Schneider Electric Modicon Controllers (Update A) CISA ICS & IT advisories · Jul 8, 2025
- SEVD-2025-161-02 Modicon Controllers M241/M251/M258/LMC058/M262 Schneider Electric CPCERT · Jul 8, 2025