CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting PLC system variables that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser.

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting PLC system variables that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser.

Schneider Electric is aware of multiple vulnerabilities in its Modicon Controllers M241 / M251 / M258 / LMC058 / M262 products.

The Modicon Controllers M241/M251/M258/M262 https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/ and Modicon LMC058 https://www.se.com/ww/en/product-range/7744-modicon-lmc058/ products are Programmable Logic Controllers for performance-demanding applications.

Failure to apply remediation/mitigations provided below may risk Cross-Site Scripting, Denial of Service or uncontrolled resource consumption which could result in loss of confidentiality, integrity and availability of the controller.

Schneider Electric is aware of multiple vulnerabilities in its Modicon Controllers M241 / M251 / M258 / LMC058 / M262 products.

The Modicon Controllers M241/M251/M258/M262 https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/ and Modicon LMC058 https://www.se.com/ww/en/product-range/7744-modicon-lmc058/ products are Programmable Logic Controllers for performance-demanding applications.

Failure to apply remediation/mitigations provided below may risk Cross-Site Scripting, Denial of Service or uncontrolled resource consumption which could result in loss of confidentiality, integrity and availability of the controller.