CVE-2025-54848,CVE-2025-54851,CVE-2025-54849,CVE-2025-54850
A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted series of network requests can lead to a denial of service. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.
The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.
Socomec DIRIS Digiware M-70 1.6.9
DIRIS Digiware M-70 - https://www.socomec.us/en-us/reference/48290222
7.5 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-306 - Missing Authentication for Critical Function
The DIRIS Digiware M-50/M-70 gateway functions as the access point for industrial power monitoring systems, providing power supply and communication connection to devices in the electrical installation. It also includes a webserver WEBVIEW-M for the remote visualisation and analysis of measurements and consumption.
The Socomec M-70 includes Modbus TCP and Modbus RTU over TCP services that are used by its configuration software called Easy Config System. An attacker could send an unauthenticated packet using the Modbus TCP or Modbus RTU over TCP protocol to remotely modify the Modbus RTU settings, resulting in a denial-of-service condition.
Specifically, an attacker can disrupt communications over Modbus TCP, Modbus RTU over TCP, and Modbus RTU by sending a crafted Modbus TCP or Modbus RTU over TCP message that changes the gateway’s Modbus address. This modification interrupts communication between the gateway and all connected tools or devices across Modbus TCP, Modbus RTU over TCP, and Modbus RTU networks.
After such an attack, if the Modbus address in a received Modbus TCP or Modbus RTU over TCP packet does not match the configured address of the M-70 gateway, the gateway will no longer respond to Modbus RTU over TCP requests, and and subsequent Modbus TCP requests receive an exception response with error code 11 (“Gateway target device failed to respond”).
An attacker can trigger this denial-of-service condition by sending a sequence of Modbus TCP messages to port 502 using the Write Single Register function code (6). The attack sequence begins with a message to register 58112 with a value of 1000, indicating that a configuration change will follow. Next, a message is sent to register 29440 with a value corresponding to the new Modbus address to be configured. Finally, a message to register 57856 with a value of 161 commits the configuration change. After this configuration change, the device will be in a denial-of-service state.
Using the Cyber Security user profile in WEBVIEW-M, disable Modbus over Ethernet Writing.
An attacker can trigger this denial-of-service condition by sending a single Modbus TCP message to port 502 using the Write Single Register function code (6) to write the value 1 to register 4352. This action changes the Modbus address to 15. After this message is sent, the device will be in a denial-of-service state.
Using the Cyber Security user profile in WEBVIEW-M, disable Modbus over Ethernet Writing.
An attacker can trigger this denial-of-service condition by sending a sequence of Modbus RTU over TCP messages to port 503 using the Write Single Register function code (6). The attack sequence begins with a message to register 58112 with a value of 1000, indicating that a configuration change will follow. Next, a message is sent to register 29440 with a value corresponding to the new Modbus address to be configured. Finally, a message to register 57856 with a value of 161 commits the configuration change. After this configuration change, the device will be in a denial-of-service state.
Using the Cyber Security user profile in WEBVIEW-M, disable Modbus over Ethernet Writing.
An attacker can trigger this denial-of-service condition by sending a single Modbus TCP message to port 503 using the Write Single Register function code (6) to write the value 1 to register 4352. This action changes the Modbus address to 15. After this message is sent, the device will be in a denial-of-service state.
Using the Cyber Security user profile in WEBVIEW-M, disable Modbus over Ethernet Writing.
https://www.socomec.fr/sites/default/files/2025-11/CVE-2025-54848—Diris-Digiware-Mxx—CV_VULNERABILITIES_2025-10-29-10-40-47_English_PLURI.pdf https://www.socomec.fr/sites/default/files/2025-11/CVE-2025-54849—Diris-Digiware-Mxx—CV_VULNERABILITIES_2025-10-29-10-38-34_English_PLURI.pdf https://www.socomec.fr/sites/default/files/2025-11/CVE-2025-54850—Diris-Digiware-Mxx—CV_VULNERABILITIES_2025-10-29-11-35-20_English_PLURI.pdf
2025-08-21 - Vendor Disclosure
2025-10-28 - Vendor Patch Release
2025-12-01 - Public Release
Discovered by Kelly Patterson of Cisco Talos.