CVE-2024-6528 is a Cross-Site Scripting (XSS) vulnerability (CWE-79) affecting multiple Schneider Electric Modicon controllers and their firmware, including the LMC058, M241, M251, and M258 series. With a CVSS score of 6.1 (Medium), this vulnerability allows an unauthenticated attacker to inject arbitrary JavaScript into a web page, which would then execute in a victim's browser upon visiting the compromised page. The attack requires user interaction (UI:R) and has low impact on confidentiality and integrity (C:L/I:L). Currently, there is no evidence of active exploitation, no known public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage, indicating a low immediate threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:schneider-electric:modicon_m241_firmware:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:schneider-electric:modicon_m251_firmware:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:schneider-electric:modicon_m258_firmware:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:schneider-electric:modicon_m262_firmware:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:schneider-electric:modicon_lmc058_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.