CVE-2025-23417
📋 TL;DR
An unauthenticated denial-of-service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 devices. Attackers can send specially crafted network packets to crash the device, disrupting power monitoring and control operations. This affects organizations using vulnerable versions of these industrial power monitoring systems.
💻 Affected Systems
- Socomec DIRIS Digiware M-70
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device crash requiring physical restart, disrupting power monitoring and potentially affecting connected industrial processes that rely on this data.
Likely Case
Temporary service disruption of the DIRIS Digiware M-70 device, requiring manual restart to restore functionality.
If Mitigated
Minimal impact if devices are behind firewalls with strict network segmentation and access controls.
🎯 Exploit Status
The vulnerability requires sending specially crafted packets to the Modbus RTU over TCP service, which is relatively straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contact Socomec for updated firmware
Vendor Advisory: https://www.socomec.fr/sites/default/files/2025-04/CVE-2025-23417---Diris-Digiware-Webview-_VULNERABILITIES_2025-04-11-17-16-19_English_0.pdf
Restart Required: Yes
Instructions:
1. Contact Socomec support for updated firmware
2. Backup device configuration
3. Apply firmware update following Socomec instructions
4. Restart device
5. Verify functionality
🔧 Temporary Workarounds
Network Segmentation
allIsolate DIRIS Digiware devices on separate VLANs with strict firewall rules limiting access to authorized systems only.
Disable Modbus RTU over TCP
allIf not required, disable Modbus RTU over TCP functionality in device configuration.
🧯 If You Can't Patch
- Implement strict network access controls to limit traffic to DIRIS Digiware devices only from authorized management systems
- Monitor network traffic for anomalous Modbus packets and implement intrusion detection rules
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or serial console. If running version 1.6.9 with Modbus RTU over TCP enabled, device is vulnerable.Check Version:
Check via web interface at http://[device-ip]/ or via serial console connectionVerify Fix Applied:
After applying firmware update, verify version is no longer 1.6.9 and test Modbus functionality remains operational.📡 Detection & Monitoring
Log Indicators:
- Device crash/restart logs
- Modbus service failure messages
- Unusual network connection attempts to port 502
Network Indicators:
- Malformed Modbus TCP packets to port 502
- High volume of connection attempts to DIRIS devices
- Traffic from unexpected sources to industrial control ports
SIEM Query:
source="network_firewall" dest_port=502 AND (packet_size>normal OR protocol_violation=true)