CVE-2025-13901
Improper Resource Shutdown in Machine Expert Causes DoS
Publication date: 2026-03-10
Last updated on: 2026-03-10
Assigner: Schneider Electric SE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| schneider_electric | modicon_m241 | to 5.4.13.12 (exc) |
| schneider_electric | modicon_m251 | to 5.4.13.12 (exc) |
| schneider_electric | modicon_m262 | to 5.4.10.12 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-404 | The product does not release or incorrectly releases a resource before it is made available for re-use. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-13901 is an Improper Resource Shutdown or Release vulnerability (CWE-404) affecting Schneider Electric Modicon Controllers M241, M251, and M262. This vulnerability allows an unauthenticated attacker to send a malicious payload that occupies active communication channels on the Machine Expert protocol.
As a result, the controllers experience a partial Denial of Service (DoS), causing loss of availability and disruption in their operation.
How can this vulnerability impact me? :
This vulnerability can cause a partial Denial of Service on affected Schneider Electric Modicon controllers by occupying active communication channels, which leads to loss of controller availability.
Such disruption can impact performance-demanding applications relying on these controllers, potentially causing operational downtime or degraded system functionality.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2025-13901 vulnerability, immediate steps include updating the firmware of affected Schneider Electric Modicon controllers to the fixed versions:
- For Modicon M241 and M251, update to firmware version 5.4.13.12 delivered with EcoStruxure™ Machine Expert v2.5.0.1.
- For Modicon M262, update to firmware version 5.4.10.12 delivered with EcoStruxure™ Machine Expert v2.5.
After updating, reboot the controller to apply the changes.
If patching is not immediately possible, apply mitigations such as operating controllers in protected environments, restricting network exposure, using embedded firewalls to filter ports and IP addresses, employing encrypted communication links, and using VPN tunnels for remote access.
Additionally, follow Schneider Electric’s cybersecurity hardening guidelines for EcoStruxure Machine Expert and Modicon controllers.