OPSWAT. Unit 515
OT & ICS Security · Vulnerability research

Reading internal files from a PLC's embedded web server

Crafted requests to the web server of a widely deployed PLC return files that should never leave the controller, without any authentication.

  • CVE-2025-2875
thanhlocpandaSenior Security Researcher · May 29, 2025 · 1 min read
On this page

Overview

Controllers in a plant often expose a web server for diagnostics. On the M241, that server resolved file references it should have rejected.

Responsible detail

This summary leaves out request details that would make the issue easier to misuse.

Timeline

  1. Feb 20, 2025

    Unit 515 reports the issue to Schneider Electric.

  2. May 13, 2025

    The vendor publishes its advisory and CVE-2025-2875.

Tags
  • OT
  • PLC

About the author

thanhlocpanda

Senior Security Researcher

Leads Unit 515 research on industrial controllers and network infrastructure, from firmware teardown to coordinated disclosure with vendors.

Keep Reading

More vulnerability deep dives from Unit 515.

Oct 16, 2026 | IoT & Embedded SecurityChaining a replayed login into full control of a home camerainsominaRead More →Mar 25, 2026 | Network SecurityFrom a lobby account to a switch that will not boot: four Catalyst 9300 CVEsthanhlocpandaRead More →Feb 26, 2026 | Network SecurityTesting public exploit claims for an SSO authentication bypasstheblackturtleRead More →
View all research

Stay Updated on Unit 515 Research

Get updates on vulnerability discoveries, technical analyses, and the latest research from OPSWAT Unit 515.

Subscribe