Analysis Summary

CVE-2025-2875

Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker manipulates the controller’s webserver URL to access resources.

Impact

• Gain Access

Indicators of Compromise

CVE

• CVE-2025-2875

Affected Vendors

Affected Products

• Schneider Modicon Controllers M241/M251 - v5.3.12.48

Remediation

Refer to Schneider Electric Security Advisory for patch, upgrade, or suggested workaround information.

Schneider Electric Security Advisory