CVE-2025-13902

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload.

Score

CVSS 3.1 5.4 Medium

Status

Analyzed - cybersecurity@se.com

Published

2026-03-10

Last modified

2026-03-10

Weaknesses

CWE-79

Affected products

• Modicon Lmc058 Firmware (Schneider-electric)
• Modicon M241 Firmware (Schneider-electric)
• Modicon M251 Firmware (Schneider-electric)
• Modicon M258 Firmware (Schneider-electric)
• Modicon Controllers M241m251 (Schneider Electric)
• Modicon Controllers M258lmc058 (Schneider Electric)

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-02&p_enDocType=Security+and+Safety+Notice&p_File_…