Skip to content
Fencer Vulns
medium 5.4

CVE-2025-13902 json

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition…

published 2026-03-10 8 mo ago modified 2026-06-23 4 mo ago also EUVD-2025-208500

cvss
5.4
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload.

Patch / fix

  • schneider-electric modicon_m251_firmware 5.4.13.12
  • schneider-electric modicon_m241_firmware 5.4.13.12

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-078-02 updated cvss 5.4

Schneider Electric Modicon Controllers M241, M251, M258, and LMC058

  • Schneider Electric Modicon Controllers LMC058 Modicon Controllers LMC058 Firmware all versions
    affected: mitigation download.schneider-electric.com
  • Schneider Electric Modicon Controllers M241 Modicon Controller M241 Firmware < 5.4.13.12 Schneider Electric Modicon Controllers M251 Modicon Controller M251 < 5.4.13.12
    affected: vendor fix, mitigation se.com
  • Schneider Electric Modicon Controllers M258 Modicon Controllers M258 Firmware all versions
    affected: mitigation download.schneider-electric.com
  • Schneider Electric Modicon Controllers M241 Modicon Controller M241 Firmware 5.4.13.12 Schneider Electric Modicon Controllers M251 Modicon Controller M251 Firmware 5.4.13.12
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
8 mo ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CNA 4.0 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

  • Schneider Electric Modicon Controllers M241/M251
  • Schneider Electric Modicon Controllers M258/LMC058

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.