Description
CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker manipulates controller’s webserver URL to access resources.
Scores
CVSS v3
7.5
EPSS
0.0052
EPSS Percentile
67.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-610
Status
published
Products (2)
Schneider Electric/Modicon Controllers M241 / M251
Versions prior to v5.3.12.48
Schneider Electric/Modicon Controllers M258 / LMC058
All versions
Published
May 14, 2025
Tracked Since
Feb 18, 2026