Schneider-electric Modicon M241 Firmware — known CVE vulnerabilities

Every CVE whose affected-product data names Schneider-electric Modicon M241 Firmware, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (10)

• CVE-2020-7487 — CVSS 9.8 (critical): A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on…
• CVE-2017-6028 — CVSS 9.8 (critical): An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and…
• CVE-2017-6026 — CVSS 9.1 (critical): A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to…
• CVE-2019-6820 — CVSS 8.2 (high): A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration…
• CVE-2020-7488 — CVSS 7.5 (high): A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between…
• CVE-2021-22699 — CVSS 7.5 (high): Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of…
• CVE-2017-6030 — CVSS 6.5 (medium): A predictable value range from previous values issue was discovered in Schneider Electric Modicon PLCs Modicon M221, firmware versions…
• CVE-2025-13902 — CVSS 5.4 (medium): CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition…
• CVE-2024-6528 — CVSS 5.4 (medium): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a…
• CVE-2025-13901 — CVSS 5.3 (medium): CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol…