Externally Controlled Resource Access in Schneider Electric's Web Server
CVE-2025-2875

8.7HIGH

Key Information:

Vendor

Schneider Electric
Status
Modicon Controllers M241 / M251
Modicon Controllers M258 / Lmc058
Vendor
CVE Published:
14 May 2025

What is CVE-2025-2875?

A vulnerability exists in Schneider Electric's web server that allows unauthenticated attackers to manipulate the server’s URL. This could lead to unauthorized access to sensitive resources, resulting in potential data exposure and loss of confidentiality. Proper safeguards and monitoring should be implemented to mitigate risks associated with this vulnerability.

Affected Version(s)

Modicon Controllers M241 / M251 Versions prior to v5.3.12.48

Modicon Controllers M258 / LMC058 All versions

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-2875 : Externally Controlled Resource Access in Schneider Electric's Web Server