CVE-2024-48894: Socomec Diris M-70 Info Disclosure Flaw

CVE-2024-48894 is an information disclosure vulnerability in Socomec Diris M-70 firmware caused by cleartext transmission in WEBVIEW-M. Attackers can intercept sensitive data via network sniffing. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2024-48894 Overview

CVE-2024-48894 is a cleartext transmission vulnerability in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 firmware version 1.6.9. The device transmits sensitive information over HTTP without encryption, allowing an attacker positioned on the network path to capture credentials and configuration data by passively sniffing traffic. A specially crafted HTTP request can trigger disclosure of sensitive information. The flaw is tracked under CWE-319: Cleartext Transmission of Sensitive Information and was reported by Cisco Talos.

Critical Impact
Network-adjacent attackers can passively intercept sensitive data, including authentication material, from Socomec DIRIS Digiware M-70 energy monitoring devices.

Affected Products

Socomec DIRIS Digiware M-70 firmware version 1.6.9
Socomec DIRIS Digiware M-70 hardware device
WEBVIEW-M web interface component

Discovery Timeline

2025-12-01 - CVE-2024-48894 published to NVD
2025-12-05 - Last updated in NVD database

Technical Details for CVE-2024-48894

Vulnerability Analysis

The Socomec DIRIS Digiware M-70 is an energy monitoring gateway deployed in industrial and commercial power-management environments. Its WEBVIEW-M web interface communicates with clients over unencrypted HTTP rather than HTTPS. As a result, all session data, including authentication credentials and device configuration parameters, travels across the network in plaintext.

An attacker with access to any network segment between a legitimate user and the device can capture this traffic using standard packet-capture tools. The captured data exposes administrative credentials and operational telemetry, enabling further attacks against the device and the broader operational technology (OT) network.

Root Cause

The root cause is the absence of transport-layer encryption in the WEBVIEW-M HTTP service. The firmware does not enforce TLS for management traffic, and sensitive fields, such as login credentials, are submitted in cleartext HTTP request bodies. This design flaw maps to [CWE-319].

Attack Vector

Exploitation requires network access to the path between an administrator and the DIRIS Digiware M-70 device. The attack is passive: the adversary observes HTTP traffic and extracts sensitive content from request and response payloads. No authentication, user interaction, or privilege is required on the target device.

The vulnerability is described in technical detail in the Talos Intelligence Vulnerability Report TALOS-2024-2115 and the Socomec CVE-2024-48894 Advisory.

Detection Methods for CVE-2024-48894

Indicators of Compromise

Unencrypted HTTP traffic on TCP port 80 to or from DIRIS Digiware M-70 devices containing credential fields or configuration payloads.
Unexpected administrative logins to the WEBVIEW-M interface from unfamiliar source addresses.
ARP spoofing, rogue switch port mirroring, or unauthorized SPAN sessions on OT network segments hosting Socomec gateways.

Detection Strategies

Inspect network captures for HTTP POST requests to WEBVIEW-M endpoints carrying plaintext authentication parameters.
Use network intrusion detection signatures that flag cleartext credential patterns destined for known Socomec device IP ranges.
Correlate device authentication events with source addresses outside the approved management VLAN.

Monitoring Recommendations

Continuously baseline traffic between engineering workstations and Socomec DIRIS devices to detect new or unauthorized clients.
Monitor switch logs for MAC address changes, port mirroring activity, and ARP table anomalies near OT segments.
Forward firewall and switch telemetry to a centralized analytics platform to identify passive reconnaissance against industrial assets.

How to Mitigate CVE-2024-48894

Immediate Actions Required

Restrict management access to the DIRIS Digiware M-70 web interface to a dedicated, isolated management VLAN.
Rotate all administrative credentials used on affected devices, assuming prior exposure on any shared network.
Disable remote access to the WEBVIEW-M interface from untrusted networks until a fixed firmware version is deployed.

Patch Information

Socomec has published a vendor advisory for CVE-2024-48894. Administrators should consult the Socomec CVE-2024-48894 Advisory PDF for the vendor's remediation guidance and any updated firmware releases for the DIRIS Digiware M-70.

Workarounds

Place affected devices behind a VPN or jump host that enforces encrypted access for all administrative sessions.
Segment OT networks to prevent traffic between Socomec devices and general-purpose corporate or guest networks.
Enforce strict port security and 802.1X authentication on switches connecting energy monitoring equipment to limit passive sniffing opportunities.

bash

# Example: restrict WEBVIEW-M access to a management subnet on an upstream firewall
# Replace 10.10.50.0/24 with your management VLAN and 10.20.0.10 with the device IP
iptables -A FORWARD -s 10.10.50.0/24 -d 10.20.0.10 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 10.20.0.10 -p tcp --dport 80 -j DROP