Description
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability
exists impacting PLC system variables that could cause an unvalidated data injected by authenticated
malicious user leading to modify or read data in a victim’s browser.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | Modicon Controllers M241/M251 | Versions prior to 5.3.12.51 | — |
| Schneider Electric | Modicon Controllers M258 / LMC058 | All Versions | — |
Advisories 2
- ICSA-25-175-03 Schneider Electric Modicon Controllers (Update A) CISA ICS & IT advisories · Jul 8, 2025
- SEVD-2025-161-02 Modicon Controllers M241/M251/M258/LMC058/M262 Schneider Electric CPCERT · Jul 8, 2025