CVE-2025-26858: Socomec Diris M-70 Firmware DOS Vulnerability

CVE-2025-26858 Overview

CVE-2025-26858 is a buffer overflow vulnerability in the Modbus TCP functionality of the Socomec DIRIS Digiware M-70 firmware version 1.6.9. The flaw allows an unauthenticated remote attacker to send a specially crafted sequence of network packets to trigger a denial-of-service condition on the affected device. The DIRIS Digiware M-70 is an industrial power monitoring gateway commonly deployed in electrical distribution and energy management environments. Exploitation does not require credentials, user interaction, or prior access to the device, making any Modbus TCP service reachable on the network a viable target. The vulnerability is tracked under [CWE-20] Improper Input Validation.

Critical Impact
An unauthenticated attacker with network access to the Modbus TCP service can crash the DIRIS Digiware M-70, disrupting industrial power monitoring and energy management operations.

Affected Products

Socomec DIRIS Digiware M-70 (hardware)
Socomec DIRIS Digiware M-70 firmware version 1.6.9
Related DIRIS Digiware Mxx/Dxx models referenced in the vendor advisory

Discovery Timeline

2025-12-01 - CVE-2025-26858 published to the National Vulnerability Database
2025-12-05 - Last updated in NVD database

Technical Details for CVE-2025-26858

Vulnerability Analysis

The vulnerability resides in how the DIRIS Digiware M-70 firmware processes incoming Modbus TCP packets. The Modbus TCP service accepts requests on TCP port 502 and parses Application Data Unit (ADU) fields before dispatching function codes to internal handlers. A specially crafted set of network packets causes the parser to write beyond the bounds of a fixed-size buffer. The resulting memory corruption destabilizes the firmware and forces the device into a denial-of-service state, where it stops responding to legitimate monitoring requests. According to the impact profile, confidentiality and integrity are not affected, but availability is fully compromised. The vulnerability is exploitable over the network with low attack complexity and no privileges or user interaction.

Root Cause

The root cause is improper input validation [CWE-20] in the Modbus TCP request handler. The firmware does not adequately verify the size or structure of attacker-supplied fields before copying them into an internal buffer. Because Modbus TCP is an unauthenticated protocol by design, the validation gap is reachable without any credential or session context.

Attack Vector

An attacker on the same routable network as the device sends a sequence of malformed Modbus TCP packets to TCP port 502. No authentication or user interaction is required. The crafted sequence triggers the overflow, which leads to a service crash and loss of monitoring availability. Devices exposed across flat operational technology (OT) networks, or reachable through misconfigured IT/OT boundaries, are most at risk. Refer to the Talos Intelligence Vulnerability Report and the Socomec CVE-2025-26858 advisory for additional technical detail.

Detection Methods for CVE-2025-26858

Indicators of Compromise

Unexpected restarts, watchdog resets, or loss of communication from DIRIS Digiware M-70 devices on the OT network
Bursts of malformed or oversized Modbus TCP packets directed at TCP port 502 from unauthorized hosts
Gaps in energy and power monitoring telemetry collected by upstream SCADA or building management systems

Detection Strategies

Deploy an OT-aware intrusion detection system (IDS) capable of decoding Modbus TCP and flagging malformed ADU lengths or non-compliant function code parameters
Baseline normal Modbus TCP traffic patterns to the DIRIS Digiware M-70 and alert on deviations such as new source IPs, abnormal packet sizes, or excessive request rates
Correlate device availability metrics with network telemetry to identify packet-induced crashes versus routine outages

Monitoring Recommendations

Forward firewall and switch logs for traffic to TCP port 502 into a centralized SIEM for review and long-term retention
Monitor ICMP unreachable messages and TCP reset patterns originating from DIRIS Digiware devices as early indicators of service failure
Enable continuous reachability checks against the device management interface and alert on consecutive failures

How to Mitigate CVE-2025-26858

Immediate Actions Required

Inventory all Socomec DIRIS Digiware M-70 devices running firmware 1.6.9 and identify any exposed Modbus TCP interfaces
Restrict TCP port 502 access to a strict allowlist of authorized engineering workstations and SCADA hosts using firewall or ACL rules
Segment OT networks from corporate IT and remove any direct internet exposure of the Modbus TCP service
Engage Socomec support to confirm fixed firmware availability and schedule maintenance windows for upgrade

Patch Information

Socomec has published an advisory covering CVE-2025-26858 for the DIRIS Digiware Mxx/Dxx product line. Administrators should consult the Socomec CVE-2025-26858 advisory PDF for vendor-supplied remediation guidance and contact the vendor directly for fixed firmware applicable to firmware version 1.6.9. Cross-reference the Talos Intelligence Vulnerability Report TALOS-2025-2152 for technical context before deploying changes in production.

Workarounds

Place affected devices behind an industrial firewall that performs Modbus TCP deep packet inspection and drops malformed ADUs
Disable Modbus TCP on devices where it is not required and rely on alternative management protocols supported by the vendor
Use a jump host or data diode for read-only access from IT networks to OT monitoring devices
Apply strict rate limiting on TCP port 502 to reduce the impact of repeated crafted-packet bursts

bash

# Configuration example - restrict Modbus TCP (port 502) to authorized hosts only
# Example iptables rules on an upstream Linux gateway protecting the OT segment
iptables -A FORWARD -p tcp --dport 502 -s 10.10.20.5  -d 10.20.30.40 -j ACCEPT
iptables -A FORWARD -p tcp --dport 502 -s 10.10.20.6  -d 10.20.30.40 -j ACCEPT
iptables -A FORWARD -p tcp --dport 502 -d 10.20.30.40 -j DROP
iptables -A FORWARD -p tcp --dport 502 -d 10.20.30.40 -m limit --limit 30/min -j ACCEPT