PT-2025-21143 · Schneider Electric · Lmc058+3

Published

2025-05-13

·

Updated

2025-07-31

·

CVE-2025-2875

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Modicon Controllers M241 / M251 versions prior to 5.3.12.48 Modicon Controllers M258 / LMC058 all versions
Description: A vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker manipulates the controller's webserver URL to access resources. This issue is related to an externally controlled reference to a resource in another sphere.
Recommendations: For Modicon Controllers M241 / M251 versions prior to 5.3.12.48, update to version 5.3.12.48 or later to resolve the issue. For Modicon Controllers M258 / LMC058, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-610

Related Identifiers

BDU:2025-07451
CVE-2025-2875

Affected Products

Lmc058
Modicon Controllers M241
Modicon Controllers M251
Modicon Controllers M258