CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker manipulates controller’s webserver URL to access resources.

CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker manipulates controller’s webserver URL to access resources.

Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251 / M258 / LMC058 products.

The Modicon Controllers M241/M251/M258 https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/ and Modicon LMC058 https://www.se.com/ww/en/product-range/7744-modicon-lmc058/ products are Programmable Logic Controllers for performance-demanding applications.

Failure to apply remediation/mitigations provided below may risk an unauthenticated read of arbitrary files which could result in loss of confidential data stored on the controller.

July 2025 Update: A remediation is now available within EcoStruxure™ Machine Expert v2.3 used to update the Modicon Controlers firmware.

Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251 / M258 / LMC058 products.

The Modicon Controllers M241/M251/M258 https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/ and Modicon LMC058 https://www.se.com/ww/en/product-range/7744-modicon-lmc058/ products are Programmable Logic Controllers for performance-demanding applications.

Failure to apply remediation/mitigations provided below may risk an unauthenticated read of arbitrary files which could result in loss of confidential data stored on the controller.

July 2025 Update: A remediation is now available within EcoStruxure™ Machine Expert v2.3 used to update the Modicon Controlers firmware.