CVE-2025-13901
Quick assessment
Affected
Schneider Electric Modicon M241/M251
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Schneider Electric Modicon M241等都是法国施耐德电气（Schneider Electric）公司的一款可编程逻辑控制器。 Schneider Electric多款产品存在安全漏洞，该漏洞源于资源关闭或释放不当，可能导致未经验证的攻击者发送恶意有效载荷占用活动通信通道，从而对Machine Expert协议造成部分拒绝服务。以下产品受到影响：Schneider Electric Modicon M262、Schneider Electric Modicon M241和Schne
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-13901
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不恰当的资源关闭或释放
Source: CVE Program / CVE List V5
Vulnerability Title
Schneider Electric多款产品 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Schneider Electric Modicon M241等都是法国施耐德电气（Schneider Electric）公司的一款可编程逻辑控制器。 Schneider Electric多款产品存在安全漏洞，该漏洞源于资源关闭或释放不当，可能导致未经验证的攻击者发送恶意有效载荷占用活动通信通道，从而对Machine Expert协议造成部分拒绝服务。以下产品受到影响：Schneider Electric Modicon M262、Schneider Electric Modicon M241和Schne
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Schneider Electric | Modicon M241/M251 | Versions prior to 5.4.13.12 | - |
|
| Schneider Electric | Modicon M262 | Versions prior to 5.4.10.12 | - |
|
II. Public POCs for CVE-2025-13901
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-13901
请登录查看更多情报信息。
Same Patch Batch · Schneider Electric · 2026-03-10 · 6 CVEs total
| CVE-2025-13957 | Schneider Electric EcoStruxure IT Data Center Expert 信任管理问题漏洞 | |
| CVE-2025-11739 | Schneider Electric EcoStruxure Power Monitoring Expert和Schneider Electric EcoStruxure Powe | |
| CVE-2026-1286 | Schneider Electric EcoStruxure Foxboro DCS 代码问题漏洞 | |
| CVE-2026-2273 | Schneider Electric EcoStruxure Automation Expert 代码注入漏洞 | |
| CVE-2025-13902 | Schneider Electric多款产品 跨站脚本漏洞 |
IV. Related Vulnerabilities
Same vendor: Schneider Electric
-
CVE-2026-3869
Schneider Electric Modicon M580 授权问题漏洞 -
CVE-2026-81861
Schneider Electric SCADAPack 47x 信任管理问题漏洞 -
CVE-2026-77120
Schneider Electric PowerLogic T300 命令注入漏洞 -
CVE-2026-19233
Schneider Electric EcoStruxure IT Data Center Expert 服务端请求伪造 -
CVE-2026-8044
Schneider Electric EcoStruxure IT Data Center Expert 命令注入漏洞
Same weakness: CWE-404
-
CVE-2026-103241
vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of se -
CVE-2026-47491
NVIDIA Linux驱动内核内存释放不当致代码执行漏洞 -
CVE-2026-101040
Ricoh SP 330DN/SP 221/SP C252SF/Aficio SP 3500SF HTTP Multip -
CVE-2026-94137
Hangzhou Shunwang Technology shzh IRP_MJ_DEVICE_CONTROL shdr -
CVE-2026-94094
OpenClaw Canvas Host Route server.ts createCanvasHostHandler
V. Comments for CVE-2025-13901
No comments yet