CVE-2025-54849: Socomec Diris Digiware M-70 DoS Vulnerability

CVE-2025-54849 Overview

CVE-2025-54849 is a denial of service vulnerability in the Modbus TCP and Modbus RTU over TCP functionality of the Socomec DIRIS Digiware M-70 power monitoring device running firmware version 1.6.9. An unauthenticated attacker with network access to port 502 can send a single crafted Modbus message to force the device into a denial-of-service state. The flaw is tracked as a Missing Authentication for Critical Function weakness [CWE-306]. The vulnerability impacts availability of the industrial monitoring device, which is commonly deployed in electrical distribution and energy management environments.

Critical Impact
A single unauthenticated Modbus TCP packet to port 502 changes the device's Modbus address and renders the DIRIS Digiware M-70 unresponsive, disrupting energy monitoring operations.

Affected Products

Socomec DIRIS Digiware M-70 (hardware)
Socomec DIRIS Digiware M-70 Firmware version 1.6.9
Deployments exposing Modbus TCP port 502 to untrusted networks

Discovery Timeline

2025-12-01 - CVE-2025-54849 published to NVD
2025-12-08 - Last updated in NVD database

Technical Details for CVE-2025-54849

Vulnerability Analysis

The Socomec DIRIS Digiware M-70 exposes a Modbus TCP service on TCP port 502 without requiring authentication for write operations. The Modbus protocol itself lacks built-in authentication, and the device does not enforce any application-layer access control on register writes. An attacker on the same network segment can issue Modbus function code 6 (Write Single Register) against the device. Writing the value 1 to register 4352 reassigns the device's Modbus address to 15, after which the device stops responding to legitimate polling traffic. The condition persists until administrative intervention restores normal operation. Recovery typically requires power cycling or manual reconfiguration of the affected unit.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. The device accepts privileged write operations to configuration-affecting registers from any source capable of reaching port 502. There is no session establishment, credential check, or access control list governing which clients may modify the Modbus address. Combining unauthenticated write access with a register that controls fundamental protocol addressing creates a reliable single-packet denial of service primitive.

Attack Vector

Exploitation requires only network reachability to TCP port 502 on the target device. The attacker constructs a Modbus Application Protocol (MBAP) header followed by a Write Single Register (function code 0x06) request with register address 4352 and value 0x0001. No prior authentication, user interaction, or elevated privileges are needed. After the device's Modbus address changes to 15, polling systems configured for the original address receive no response, producing a sustained outage of telemetry from the device. The vulnerability is described in the Talos Intelligence Vulnerability Report.

Detection Methods for CVE-2025-54849

Indicators of Compromise

Unexpected Modbus TCP write requests to port 502 containing function code 6 targeting register 4352
Sudden loss of Modbus telemetry responses from DIRIS Digiware M-70 devices at their configured slave address
Modbus traffic addressed to slave ID 15 where no device was previously assigned that address
Connection attempts to port 502 from hosts outside the authorized monitoring infrastructure

Detection Strategies

Deploy network intrusion detection signatures that inspect Modbus TCP payloads for function code 6 writes to register 4352
Baseline normal Modbus traffic between SCADA polling hosts and DIRIS devices, then alert on writes originating from unexpected sources
Correlate device availability monitoring with Modbus configuration register access events
Use industrial protocol-aware firewalls or DPI tooling to log all Modbus write function codes targeting DIRIS Digiware units

Monitoring Recommendations

Continuously poll managed Modbus devices for liveness and alert on response timeouts
Capture full PCAPs on OT network segments containing energy monitoring equipment for forensic review
Forward firewall and switch logs from OT segments to a central analysis platform for anomaly detection
Track changes to device Modbus addresses through asset inventory tooling and flag unauthorized modifications

How to Mitigate CVE-2025-54849

Immediate Actions Required

Restrict TCP port 502 access to a strict allowlist of authorized SCADA and monitoring hosts using firewall rules
Place DIRIS Digiware M-70 devices on isolated OT VLANs segmented from corporate IT and remote-access networks
Inventory all Socomec DIRIS Digiware M-70 units running firmware 1.6.9 and prioritize them for vendor remediation
Disable Modbus TCP on devices where it is not required for operations

Patch Information

At the time of NVD publication on 2025-12-01, no vendor patch reference is listed in the available CVE data. Operators should consult Socomec directly and review the Talos Intelligence Vulnerability Report for updated remediation guidance. Apply firmware updates from Socomec as soon as they are released for firmware version 1.6.9 and successor builds.

Workarounds

Enforce unidirectional gateways or data diodes between the OT network and any environment containing untrusted hosts
Require VPN with multi-factor authentication for any remote engineering access to networks hosting Modbus devices
Configure industrial firewalls to permit only Modbus read function codes (1, 2, 3, 4) from polling hosts and block write codes (5, 6, 15, 16) unless explicitly required
Schedule periodic verification that device Modbus addresses match the documented asset configuration

bash

# Example iptables rule restricting Modbus TCP access to a single SCADA host
iptables -A INPUT -p tcp --dport 502 -s 10.10.20.5 -j ACCEPT
iptables -A INPUT -p tcp --dport 502 -j DROP