CVE-2025-13901
Received Received - Intake
Improper Resource Shutdown in Machine Expert Causes DoS

Publication date: 2026-03-10

Last updated on: 2026-03-10

Assigner: Schneider Electric SE

Description
CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-10
Last Modified
2026-03-10
Generated
2026-06-16
AI Q&A
2026-03-10
EPSS Evaluated
2026-06-15
NVD
CVE-2025-13901
EUVD
EUVD-2025-208477
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
schneider_electric modicon_m241 to 5.4.13.12 (exc)
schneider_electric modicon_m251 to 5.4.13.12 (exc)
schneider_electric modicon_m262 to 5.4.10.12 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-13901 is an Improper Resource Shutdown or Release vulnerability (CWE-404) affecting Schneider Electric Modicon Controllers M241, M251, and M262. This vulnerability allows an unauthenticated attacker to send a malicious payload that occupies active communication channels on the Machine Expert protocol.

As a result, the controllers experience a partial Denial of Service (DoS), causing loss of availability and disruption in their operation.

Impact Analysis

This vulnerability can cause a partial Denial of Service on affected Schneider Electric Modicon controllers by occupying active communication channels, which leads to loss of controller availability.

Such disruption can impact performance-demanding applications relying on these controllers, potentially causing operational downtime or degraded system functionality.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate the CVE-2025-13901 vulnerability, immediate steps include updating the firmware of affected Schneider Electric Modicon controllers to the fixed versions:

  • For Modicon M241 and M251, update to firmware version 5.4.13.12 delivered with EcoStruxure™ Machine Expert v2.5.0.1.
  • For Modicon M262, update to firmware version 5.4.10.12 delivered with EcoStruxure™ Machine Expert v2.5.

After updating, reboot the controller to apply the changes.

If patching is not immediately possible, apply mitigations such as operating controllers in protected environments, restricting network exposure, using embedded firewalls to filter ports and IP addresses, employing encrypted communication links, and using VPN tunnels for remote access.

Additionally, follow Schneider Electric’s cybersecurity hardening guidelines for EcoStruxure Machine Expert and Modicon controllers.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13901. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart