CVE-2025-1390: Schneider Electric Modicon M241, M251, M262 DoS Vulnerability — Detection and Hardening Guide

Introduction

CISA has released ICSA-26-078-01, detailing a significant vulnerability (CVE-2025-1390) affecting Schneider Electric Modicon M241, M251, and M262 controllers. These programmable logic controllers (PLCs) are ubiquitous in Critical Manufacturing, Energy, and Commercial Facilities sectors worldwide.

The vulnerability, classified as "Improper Resource Shutdown or Release" (CWE-404), allows an attacker to trigger a Denial-of-Service (DoS) condition. While the CVSS v3 score sits at 5.3 (Medium), the operational impact in an OT environment is severe. A PLC crash halts production lines, disrupts power management, and poses safety risks. Defenders must prioritize this patch to maintain availability and integrity in industrial processes.

Technical Analysis

• Affected Products:
  • Modicon M241 (Versions prior to 5.4.13.12)
  • Modicon M251 (Versions prior to 5.4.13.12)
  • Modicon M262 (Versions prior to 5.4.10.12)
• CVE Identifier: CVE-2025-1390
• CVSS v3 Score: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
• Vulnerability Type: Improper Resource Shutdown or Release

How it Works: The vulnerability stems from the controller's failure to properly manage system resources during specific operations. An attacker can send specially crafted requests to the targeted device. Due to the improper release of resources (such as memory handles or network buffers), the PLC eventually exhausts its available capacity. This exhaustion leads to a stoppage of the control logic or a complete device reboot, resulting in a DoS condition.

Exploitation Status: As of the advisory release, there is no confirmation of active exploitation in the wild. However, the technical nature of the flaw (resource exhaustion) typically allows for easy replication once the packet structure is known. Given the ubiquity of these controllers, CISA has highlighted this as a priority for critical infrastructure defenders.

Detection & Response

Detecting resource exhaustion attacks on PLCs requires a shift from traditional endpoint monitoring (which is often limited on the controller itself) to network-based anomaly detection. In an OT environment, the Engineering Workstation (EWS) and the firewalls separating the IT/OT boundary are your primary data sources.

The following rules focus on identifying suspicious network traffic patterns indicative of a DoS attempt against the Modicon controllers, specifically monitoring for connection flooding or anomalous traffic to standard Modbus ports.

---
title: Potential DoS Attack on Schneider Modicon PLCs
id: 8c4d2e1a-5f3b-4c8e-9a1b-2c3d4e5f6a7b
status: experimental
description: Detects potential Denial-of-Service attempts characterized by a high volume of network connections to Schneider Modicon PLCs (default Modbus TCP port 502) from a single source IP within a short timeframe.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-01
author: Security Arsenal
date: 2025/02/27
tags:
  - attack.impact
  - attack.t1499
  - ics
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 502
  filter:
    SourceIp|startswith: 
      - '192.168.' # Example internal SCADA subnet - adjust to your environment
      - '10.0.'
  condition: selection and not filter | count(SourceIp) > 100 by DestinationIp, SourceIp within 1m
timeout: 30s
falsepositives:
  - Legitimate high-frequency polling from HMI/SCADA systems during normal operation
level: high
---
title: Unsolicited Modicon Traffic from IT to OT Network
id: 9d5e3f2b-6g4c-5d9f-0b2c-3d4e5f6a7b8c
status: experimental
description: Detects traffic originating from non-OT (Enterprise/IT) subnets targeting known OT PLC subnets on Modbus TCP ports. This may indicate lateral movement or probing for vulnerabilities.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-01
author: Security Arsenal
date: 2025/02/27
tags:
  - attack.lateral_movement
  - attack.t1021.001
  - ics
logsource:
  category: network_connection
  product: windows
detection:
  selection_ports:
    DestinationPort:
      - 502  # Modbus TCP
      - 503  # Often used for specific industrial protocols
  selection_source:
    SourceIp|startswith:
      - '192.168.1.' # Example IT Subnet
      - '172.16.'     # Example IT Subnet
  selection_dest:
    DestinationIp|startswith:
      - '10.10.20.'   # Example OT Subnet
  condition: all of selection_*
falsepositives:
  - Authorized engineering laptop connecting from a different VLAN
level: medium

Microsoft Sentinel / Defender KQL

Use this query to hunt for connection spikes to your industrial zones. This assumes you are ingesting firewall logs or CEF/Syslog data into Sentinel.

let OT_Zone_Prefixes = dynamic(['10.10.20.0/24', '192.168.50.0/24']); // Update with your OT subnets
let Modbus_Ports = dynamic([502, 503]);
CommonSecurityLog
| where DestinationPort in (Modbus_Ports)
| where ipv4_is_in_range(DestinationIP, OT_Zone_Prefixes) 
| summarize Count = count() by SourceIP, DestinationIP, bin(TimeGenerated, 1m)
| where Count > 50 // Threshold for potential flooding
| project TimeGenerated, SourceIP, DestinationIP, Count, Message
| order by TimeGenerated desc

Velociraptor VQL

This VQL artifact is designed to run on an Engineering Workstation or a Jump Server within the OT network. It monitors active network connections to identify processes communicating with the known Modicon PLCs on port 502, helping to spot unauthorized tools or malicious scripts.

-- Hunt for processes connecting to Modicon PLCs (Port 502)
SELECT 
  timestamp(epoch=StartTime) as StartTime,
  Pid, 
  Name, 
  Username, 
  Cmdline,
  RemoteAddr,
  RemotePort
FROM netstat()
WHERE RemotePort = 502
  AND State = 'ESTABLISHED'
GROUP BY Pid

Remediation Script (PowerShell)

Since you cannot execute scripts directly on the PLCs, use this PowerShell script on your network administration workstation to scan your subnet for devices listening on Modbus TCP (Port 502). This assists in creating an accurate asset inventory for patching.

# Asset Discovery Script for Modicon Devices (Port 502)
# Requires Administrator privileges

param(
    [string]$Subnet = "10.10.20" # Define your /24 subnet here (e.g., 192.168.1)
)

$OpenPorts = @()

Write-Host "[+] Scanning Subnet: ${Subnet}.0/24 for Modbus TCP (502)..." -ForegroundColor Cyan

1..254 | ForEach-Object {
    $IP = "${Subnet}.$_"
    try {
        $Connection = New-Object System.Net.Sockets.TcpClient
        $Connection.ReceiveTimeout = 500 # Short timeout for speed
        $Connect = $Connection.BeginConnect($IP, 502, $null, $null)
        $Wait = $Connect.AsyncWaitHandle.WaitOne(500, $false)
        
        if ($Wait) {
            $Connection.EndConnect($Connect)
            $OpenPorts += $IP
            Write-Host "[+] Found Active Modbus Device: $IP" -ForegroundColor Green
        }
        $Connection.Close()
    } catch {
        # Host unreachable or port closed
    }
}

if ($OpenPorts.Count -eq 0) {
    Write-Host "[-] No devices found on port 502 in the specified subnet." -ForegroundColor Yellow
} else {
    Write-Host "\n[+] Scan Complete. Identified $($OpenPorts.Count) devices." -ForegroundColor Cyan
    Write-Host "[+] Action Item: Verify firmware versions on these IPs against CVE-2025-1390 requirements."
}

Remediation

To mitigate CVE-2025-1390, Schneider Electric has released firmware updates that correct the resource management flaw. Follow these steps immediately:

1. Apply Firmware Updates: Update affected controllers to the following specific versions or later:

   • Modicon M241: Update to version 5.4.13.12 or later.
   • Modicon M251: Update to version 5.4.13.12 or later.
   • Modicon M262: Update to version 5.4.10.12 or later.

2. Network Segmentation: Ensure PLCs are placed behind a firewall or Unidirectional Gateway. restrict Modbus TCP (Port 502) traffic only to authorized Engineering Workstations and SCADA servers. Block all inbound access from the general IT network or Internet.

3. Minimize Attack Surface: Disable any unused network services or protocols on the controllers.

4. Obtain Patches: Download the firmware updates directly from the Schneider Electric Support Download Center.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub