CVE-2025-13901: Medium severity Schneider-electric Modicon M241 Firmware vulnerability
Published Mar 10, 2026
·Updated
CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels.
Affected Software
6 affected components
All of the following
Schneider-electric Modicon M241 Firmware<5.4.13.12
Schneider-electric Modicon M241
All of the following
Schneider-electric Modicon M251 Firmware<5.4.13.12
Schneider-electric Modicon M251
All of the following
Schneider-electric Modicon M262 Firmware<5.4.10.12
Schneider-electric Modicon M262
Remediation
Event History
Mar 10, 2026
CVE Published
via MITRE·05:02 PM
Data Sourced
via MITRE·05:02 PM
DescriptionWeakness
Data Sourced
via NVD·06:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-13901?
The severity of CVE-2025-13901 is medium with a CVSS score of 6.9.
2
What type of vulnerability is CVE-2025-13901?
CVE-2025-13901 is an improper resource shutdown or release vulnerability that may lead to partial Denial of Service.
3
How can I fix CVE-2025-13901?
CVE-2025-13901 can be fixed by applying the available patch from the vendor.
4
Which software is affected by CVE-2025-13901?
CVE-2025-13901 affects Schneider-electric Modicon M241, M251, and M262 Firmware.
5
What could happen if CVE-2025-13901 is exploited?
If exploited, CVE-2025-13901 could allow an unauthenticated attacker to occupy active communication channels, causing a partial Denial of Service.