CVE-2024-49572
📋 TL;DR
An unauthenticated denial-of-service vulnerability in Socomec DIRIS Digiware M-70's Modbus TCP functionality allows attackers to send specially crafted packets that can crash the device and reset credentials to default documented values. This affects industrial control systems using DIRIS Digiware M-70 version 1.6.9. Attackers can exploit this without authentication over the network.
💻 Affected Systems
- Socomec DIRIS Digiware M-70
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Device becomes completely unresponsive, requiring physical reset, while credentials revert to publicly documented defaults, enabling full device compromise.
Likely Case
Temporary service disruption and credential reset requiring manual intervention to restore proper authentication.
If Mitigated
Limited impact if device is behind proper network segmentation and default credentials are changed.
🎯 Exploit Status
Exploit requires crafting specific Modbus TCP packets but no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contact Socomec for updated firmware
Vendor Advisory: https://www.socomec.fr/sites/default/files/2025-04/CVE-2024-49572---Diris-Digiware-Webview-_VULNERABILITIES_2025-04-11-17-12-08_English_0.pdf
Restart Required: Yes
Instructions:
1. Contact Socomec support for patched firmware. 2. Backup device configuration. 3. Apply firmware update following vendor instructions. 4. Verify patch application and restore configuration.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to Modbus TCP port 502 to trusted networks only.
firewall rules to block port 502 from untrusted networks
Change Default Credentials
allEnsure all default documented credentials are changed to strong, unique values.
Use device management interface to change passwords
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach port 502/TCP
- Monitor for unusual Modbus traffic patterns and failed authentication attempts
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or serial console. If version is 1.6.9, device is vulnerable.Check Version:
Check via web interface at http://<device-ip> or serial console connectionVerify Fix Applied:
Verify firmware version is updated beyond 1.6.9 per vendor guidance.📡 Detection & Monitoring
Log Indicators:
- Device crash/restart logs
- Authentication failures followed by successful login with default credentials
Network Indicators:
- Unusual Modbus TCP packets to port 502
- Traffic patterns matching exploit signatures
SIEM Query:
source_port:502 AND (packet_size:<normal> OR protocol_anomaly:true)