CVE-2025-54849
📋 TL;DR
An unauthenticated denial-of-service vulnerability in Socomec DIRIS Digiware M-70 allows attackers to crash the device by sending a specially crafted Modbus TCP packet. This affects industrial control systems using version 1.6.9 of the device, potentially disrupting power monitoring and management operations.
💻 Affected Systems
- Socomec DIRIS Digiware M-70
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device outage requiring physical reset, disrupting power monitoring and control functions in critical infrastructure environments.
Likely Case
Device becomes unresponsive to Modbus communications, requiring manual reboot to restore functionality.
If Mitigated
Minimal impact if network segmentation and access controls prevent unauthorized access to Modbus port 502.
🎯 Exploit Status
Exploit requires sending a single Modbus TCP packet with function code 6 to register 4352 with value 1. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available at time of analysis
Restart Required: No
Instructions:
Check Socomec website for security advisories and firmware updates. Contact vendor support for patch availability.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Modbus devices from untrusted networks using firewalls or VLANs
Port Restriction
linuxBlock external access to TCP port 502 using firewall rules
iptables -A INPUT -p tcp --dport 502 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit Modbus traffic to authorized sources only
- Deploy intrusion detection systems to monitor for Modbus function code 6 writes to register 4352
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or serial console. If version is 1.6.9, device is vulnerable.Check Version:
Check via device web interface or use Modbus function code to read device information registersVerify Fix Applied:
Verify firmware version has been updated beyond 1.6.9. Test Modbus functionality remains operational after attempted exploitation.📡 Detection & Monitoring
Log Indicators:
- Device becoming unresponsive
- Modbus communication failures
- Unexpected device reboots
Network Indicators:
- Modbus TCP packets with function code 6 to register 4352 with value 1
- Multiple connection attempts to port 502 from unauthorized sources
SIEM Query:
source_port=502 AND (modbus.function_code=6 AND modbus.register_address=4352 AND modbus.register_value=1)