CVE-2025-13901

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-10 · updated 2026-06-23
Weakness: CWE-404

Description

CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels.

Affected products

Schneider-Electric Modicon M241 Firmware: before 5.4.13.12 — fixed in 5.4.13.12
Schneider-Electric Modicon M251 Firmware: before 5.4.13.12 — fixed in 5.4.13.12
Schneider-Electric Modicon M262 Firmware: before 5.4.10.12 — fixed in 5.4.10.12

How to fix

Upgrade to a fixed version: Schneider-Electric Modicon M241 Firmware 5.4.13.12; Schneider-Electric Modicon M251 Firmware 5.4.13.12; Schneider-Electric Modicon M262 Firmware 5.4.10.12. Check the vendor advisory for mitigations.

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-01.pdf

Get alerted when CVE-2025-13901 or the next vulnerability affects your stack