CVE-2024-53684
📋 TL;DR
A CSRF vulnerability in Socomec DIRIS Digiware M-70's WEBVIEW-M functionality allows attackers to craft malicious webpages that trick authenticated users into performing unauthorized actions. This affects users of DIRIS Digiware M-70 devices running version 1.6.9. Attackers can exploit this to gain unauthorized access to device functions.
💻 Affected Systems
- Socomec DIRIS Digiware M-70
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing configuration changes, data theft, or disruption of power monitoring functions
Likely Case
Unauthorized configuration changes or data access through tricking authenticated users
If Mitigated
Limited impact if CSRF protections are implemented and users follow security best practices
🎯 Exploit Status
Requires user to be authenticated and visit malicious webpage; typical CSRF exploitation pattern
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contact Socomec for updated firmware
Vendor Advisory: https://www.socomec.fr/sites/default/files/2025-10/CVE-2024-53684---Diris-Digiware-Mxx-Dxx-_VULNERABILITIES_2025-10-01-16-43-14_English_0.pdf
Restart Required: Yes
Instructions:
1. Contact Socomec support for updated firmware
2. Backup current configuration
3. Apply firmware update following vendor instructions
4. Verify functionality post-update
🔧 Temporary Workarounds
Implement CSRF tokens
allAdd anti-CSRF tokens to web interface forms
SameSite cookie attribute
allSet SameSite=Strict or Lax on session cookies
🧯 If You Can't Patch
- Isolate device on separate network segment with strict access controls
- Implement web application firewall with CSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or CLI; version 1.6.9 is vulnerableCheck Version:
Check via web interface: System > About or via CLI if availableVerify Fix Applied:
Verify firmware version is updated beyond 1.6.9 and test CSRF protection mechanisms📡 Detection & Monitoring
Log Indicators:
- Unexpected configuration changes
- Multiple failed authentication attempts followed by successful changes
Network Indicators:
- HTTP requests with missing or predictable CSRF tokens
- Requests from unexpected referrers
SIEM Query:
source="diris-digiware" AND (event_type="config_change" AND user_agent CONTAINS "malicious" OR referrer NOT IN allowed_domains)