CVE-2025-2875

Summary

CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker manipulates controller’s webserver URL to access resources.

Affected Software

VendorProductVersion RangeStatus
Schneider ElectricModicon Controllers M241 / M251Versions prior to v5.3.12.48affected
Schneider ElectricModicon Controllers M258 / LMC058All versionsaffected

Weaknesses

  • CWE-610: CWE-610 Externally Controlled Reference to a Resource in Another Sphere

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References