CVE-2025-20085: Socomec Diris M-70 Firmware DOS Vulnerability

CVE-2025-20085 Overview

CVE-2025-20085 is a denial of service vulnerability in the Modbus RTU over TCP functionality of the Socomec DIRIS Digiware M-70 industrial energy monitoring device running firmware version 1.6.9. A specially crafted network packet causes the device to enter a denial of service state and weakens stored credentials, reverting them to the vendor's default documented values. An attacker can trigger the vulnerability by sending a single unauthenticated packet to the device. The flaw is classified as [CWE-306] Missing Authentication for Critical Function.

Critical Impact
Unauthenticated network attackers can disrupt operational technology (OT) availability and force the device back to default credentials, enabling follow-on unauthorized access.

Affected Products

Socomec DIRIS Digiware M-70 (hardware)
Socomec DIRIS Digiware M-70 firmware version 1.6.9
Deployments exposing Modbus RTU over TCP on the network

Discovery Timeline

2025-12-01 - CVE-2025-20085 published to the National Vulnerability Database
2025-12-05 - Last updated in the NVD database

Technical Details for CVE-2025-20085

Vulnerability Analysis

The DIRIS Digiware M-70 is a multi-function metering gateway used in industrial and building power monitoring. It exposes a Modbus RTU over TCP service on the network for telemetry and configuration. The service accepts unauthenticated traffic on its listening port, allowing any reachable client to interact with the device.

Processing of a specially crafted Modbus packet causes two distinct effects. First, the device enters a denial of service condition that interrupts metering and management functions. Second, the credential store is weakened, and the device reverts to the documented default credentials published by the vendor.

Loss of availability on a metering gateway disrupts visibility into power infrastructure, and the credential reset gives an attacker a foothold for authenticated follow-on access using publicly known defaults.

Root Cause

The root cause is missing authentication on a critical function [CWE-306]. The Modbus RTU over TCP handler processes attacker-supplied packets without validating the sender, and a crafted message reaches code paths that modify credential state and disrupt service operation.

Attack Vector

Exploitation requires only network reachability to the Modbus RTU over TCP service. No user interaction, no prior authentication, and no privileges are required. The attacker sends a single crafted packet to trigger both the denial of service and the credential weakening behavior. Devices exposed to flat OT networks, jump hosts, or the internet are at the highest risk.

No public proof-of-concept code is currently available. Technical details are described in the Talos Intelligence Vulnerability Report TALOS-2025-2138 and the Socomec CVE-2025-20085 advisory.

Detection Methods for CVE-2025-20085

Indicators of Compromise

DIRIS Digiware M-70 devices becoming unresponsive or restarting unexpectedly while running firmware 1.6.9.
Successful authentication to the device using the vendor's documented default credentials after a prior known good configuration.
Unexpected inbound traffic to Modbus TCP port 502 (or the configured Modbus RTU over TCP port) from non-engineering hosts.
Loss of telemetry from the M-70 gateway in the upstream monitoring or SCADA platform.

Detection Strategies

Monitor for malformed or oversized Modbus RTU over TCP frames using an OT-aware intrusion detection system or deep packet inspection.
Alert on any administrative session to the M-70 web interface authenticated with default credentials.
Correlate device availability loss with concurrent Modbus traffic spikes from unauthorized sources.

Monitoring Recommendations

Forward syslog and Modbus session metadata from the M-70 and upstream switches into a centralized analytics platform for anomaly review.
Baseline normal Modbus client IP addresses and function codes, then alert on deviations.
Track firmware version and credential state of all DIRIS Digiware gateways in asset inventory.

How to Mitigate CVE-2025-20085

Immediate Actions Required

Restrict network access to the M-70 Modbus RTU over TCP service to a small allow-list of engineering hosts using firewall or VLAN segmentation.
Place the device behind an OT firewall or data diode and block exposure from corporate and external networks.
Audit current credentials on all DIRIS Digiware M-70 units and replace any default values with strong, unique passwords.
Verify firmware version against the latest fixed release published by Socomec and plan an upgrade window.

Patch Information

Socomec has published a security advisory for CVE-2025-20085 covering the DIRIS Digiware product line. Review the Socomec CVE-2025-20085 advisory PDF for the fixed firmware version and apply the update to all devices running firmware 1.6.9. After patching, reset credentials again to ensure no default values remain active.

Workarounds

Disable Modbus RTU over TCP on devices that do not require remote Modbus access, and rely on local serial connectivity only.
Enforce network segmentation between IT and OT zones following the IEC 62443 zone and conduit model.
Deploy a Modbus-aware gateway or proxy that filters function codes and rate-limits unauthenticated clients in front of the M-70.

bash

# Example firewall rule to restrict Modbus TCP access to authorized engineering subnet
iptables -A INPUT -p tcp --dport 502 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 502 -j DROP