CVE-2025-3898: Schneider Electric Modicon Controllers m241/m251

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends HTTPS request containing invalid data type to the webserver.

Affected products

• Schneider Electric Modicon Controllers m241/m251: before 5.3.12.51 (fixed in 5.3.12.51)
• Schneider Electric Modicon Controllers m262: before 5.3.9.18 (fixed in 5.3.9.18)

Published 2025-06-10. Last modified 2026-06-17.