Vulnerability · Published Jun 10, 2025 · Assigned by schneider
CVE-2025-3116
Medium 6.5
In plain English
A medium-severity improper input validation in Modicon Controllers M241/M251 from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 58.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends special malformed HTTPS request containing improper formatted body data to the controller.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | Modicon Controllers M241/M251 | Versions prior to 5.3.12.51 |
| Schneider Electric | Modicon Controllers M258 / LMC058 | All Versions |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H