Medium severity · published Jun 10, 2025
CVE-2025-3116
CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends special malformed HTTPS request containing…
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an
authenticated malicious user sends special malformed HTTPS request containing improper formatted body
data to the controller.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
Modicon Controllers M241/M251 · Schneider Electric
Versions prior to 5.3.12.51 · source: vendor
MC
Modicon Controllers M258 / LMC058 · Schneider Electric
All Versions · source: vendor
Affected product
MC
Modicon Controllers M241/M251
Schneider Electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3116
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3116
download.schneider-electric.com
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-161-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-161-02.pdf
More from Modicon Controllers M241/M251
7.5
CVE-2025-2875
CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker…
6.5
CVE-2025-3112
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause Denial of Service when an authenticated malicious user sends manipulated HTTPS Content-Length…
6.5
CVE-2025-3898
CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends HTTPS request containing invalid data type to…
5.4
CVE-2025-13902
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have…
5.4
CVE-2025-3117
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting configuration file paths that could cause an…