CVE-2025-3905: Schneider Electric Modicon Controllers m241/m251

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting PLC system variables that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser.

Affected products

Published 2025-06-10. Last modified 2026-06-17.