Cisco Talos Advisory: Socomec DIRIS M-70 Unauthenticated Modbus DoS (CVE-2025-54848)

Critical Vulnerability Information Report Number: TALOS-2025-2248 CVE IDs: CVE-2025-54848, CVE-2025-54851, CVE-2025-54849, CVE-2025-54850 Summary: Socomec DIRIS Digiware M-70's Modbus TCP and Modbus RTU over TCP functionalities are affected by denial-of-service vulnerabilities. Attackers can trigger this vulnerability by sending a series of unauthenticated network requests, resulting in service disruption. Confirmed Affected Versions: Socomec DIRIS Digiware M-70 1.6.9 CVSSv3 Score: 7.5 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE Category: CWE-306 - Critical Function Without Authentication Details: DIRIS Digiware M-50/M-70 serves as an access point for industrial power monitoring systems, providing communication connectivity for devices within power supply and electrical installations. It also includes a web server named WEBVIEW-M, enabling remote visualization and analysis of measurements and consumption data. Socomec M-70 includes Modbus TCP and Modbus RTU over TCP services used by its configuration software, Easy Config System. Attackers can send unauthenticated packets using Modbus TCP or Modbus RTU over TCP protocols to remotely modify Modbus RTU settings, leading to a denial-of-service condition. CVE-2025-54848 - Modbus TCP - Modbus Address Modification Attackers can trigger this denial-of-service condition by sending a sequence of Modbus TCP messages to port 502 using the Write Single Register function code (6). The attack begins by sending a message to register 58112 with a value of 1000, indicating a configuration change. Next, a message is sent to register 29440 with the value corresponding to the new Modbus address. Finally, a message is sent to register 57856 with a value of 161 to commit the configuration change. After the change, the device enters a denial-of-service state. CVE-2025-54849 - Modbus TCP - UPS Default Settings Attackers can trigger this denial-of-service condition by sending a Modbus TCP message to port 502 using the Write Single Register function code (6), writing the value 1 to register 4352. This action changes the Modbus address to 15. After sending this message, the device enters a denial-of-service state. CVE-2025-54850 - Modbus RTU over TCP - Modbus Address Modification Attackers can trigger this denial-of-service condition by sending a sequence of Modbus RTU over TCP messages to port 503 using the Write Single Register function code (6). The attack sequence is identical to the one described for CVE-2025-54848. CVE-2025-54851 - Modbus RTU over TCP - UPS Default Settings Similarly, attackers can trigger this denial-of-service condition by sending a Modbus TCP message to port 503. Mitigation: Use the Network Security User Profile in WEBVIEW-M to disable Modbus Ethernet write access. Timeline: 2025-08-21 - Vendor Disclosure 2025-10-28 - Vendor Patch Released 2025-12-01 - Report Published Discoverer: Discovered by Kelly Patterson of Cisco Talos.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco Talos Advisory: Socomec DIRIS M-70 Unauthenticated Modbus DoS (CVE-2025-54848)