CVE-2025-3117: Schneider Electric Modicon Controllers m241/m251

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting configuration file paths that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser.

Affected products

• Schneider Electric Modicon Controllers m241/m251: before 5.3.12.51 (fixed in 5.3.12.51)
• Schneider Electric Modicon Controllers m262: before 5.3.9.18 (fixed in 5.3.9.18)

Published 2025-06-10. Last modified 2026-06-17.