CVE-2024-6528 Schneider Electric CVE debrief

Who should care

Organizations operating Schneider Electric Modicon M241, M251, M262, or M258/LMC058 controllers in industrial automation environments, particularly those with web interfaces exposed to operational networks or with multiple users accessing controller web pages.

Technical summary

The vulnerability is a stored or reflected cross-site scripting (XSS) issue in the web interface of affected Schneider Electric Modicon Controllers. An attacker can inject malicious JavaScript payloads that execute when a victim accesses a compromised page. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates network attack vector, low attack complexity, low privileges required, user interaction required, changed scope, with low impacts to confidentiality and integrity but no availability impact. Remediation requires firmware updates delivered through EcoStruxure Machine Expert v2.2.2, with specific version requirements varying by controller model. Update A (October 2025) clarified affected versions for M258/LMC058 and added targeted mitigations.

Defensive priority

medium

Recommended defensive actions

• Apply vendor-provided firmware updates: M241 and M251 to version 5.2.11.24, M262 to version 5.2.8.26, available through EcoStruxure Machine Expert v2.2.2 and Schneider Electric Software Update (SESU)
• For M258/LMC058 controllers, use Controller Assistant from EcoStruxure Machine Expert to apply updates and perform reboot
• Update engineering workstations to EcoStruxure Machine Expert v2.2.2 before updating controller firmware
• Test patches in a non-production environment using backups before production deployment
• Minimize network exposure by placing controllers in protected environments with no direct internet access
• Enable and enforce strong user management and password features
• Deactivate the webserver when not in use
• Implement encrypted communication links and network segmentation with firewall rules blocking unauthorized access to ports 80/HTTP and 443/HTTPS

Evidence notes

CVE published 2024-12-19; modified 2025-10-21. Source advisory ICSA-24-354-07 from CISA CSAF. CVSS 5.4 (MEDIUM). Not in CISA KEV. Affects Schneider Electric Modicon Controllers M241 (<5.2.11.24), M251 (<5.2.11.24), M262 (<5.2.8.26), and M258/LMC058 (all versions, with Update A modifying affected version details and adding mitigations).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.