CVE-2025-54849 Overview
A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 firmware version 1.6.9. This vulnerability allows an unauthenticated remote attacker to render the device inoperable by sending specially crafted network requests to the Modbus TCP service running on port 502.
The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), as the device fails to implement proper authentication controls for critical Modbus register write operations. An attacker can exploit this flaw by sending a single unauthenticated Modbus TCP message using the Write Single Register function code (6) to modify register 4352, effectively changing the Modbus address and placing the device into a denial-of-service state.
Critical Impact
Unauthenticated remote attackers can completely disable Socomec DIRIS Digiware M-70 industrial monitoring devices with a single network packet, potentially disrupting critical infrastructure monitoring and power management systems.
Affected Products
- Socomec DIRIS Digiware M-70 Firmware version 1.6.9
- Socomec DIRIS Digiware M-70 Hardware
Discovery Timeline
- 2025-12-01 - CVE-2025-54849 published to NVD
- 2025-12-08 - Last updated in NVD database
Technical Details for CVE-2025-54849
Vulnerability Analysis
This vulnerability carries a CVSS 3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The scoring reflects the network-accessible attack vector, low attack complexity, and the complete impact on system availability without requiring any privileges or user interaction.
The EPSS (Exploit Prediction Scoring System) data indicates a probability score of approximately 0.057% with a percentile ranking of 17.754, suggesting a relatively low likelihood of exploitation in the wild at this time. However, given the simplicity of the attack and the critical nature of industrial control systems, organizations should prioritize remediation.
The vulnerability resides in the Modbus TCP implementation of the DIRIS Digiware M-70, an industrial power monitoring device commonly deployed in energy management and industrial automation environments. The device exposes Modbus services on TCP port 502 without implementing authentication mechanisms for critical configuration registers.
Root Cause
The root cause of this vulnerability is the absence of authentication controls for critical Modbus register write operations (CWE-306: Missing Authentication for Critical Function). The device allows any network-accessible client to modify sensitive configuration registers via the Modbus TCP protocol without requiring credentials or authorization.
Specifically, register 4352 controls the Modbus address configuration of the device. When this register is modified by an attacker, the device's Modbus communication parameters are altered, causing it to become unresponsive to legitimate requests and effectively creating a denial-of-service condition.
Attack Vector
The attack is executed over the network with minimal complexity. An attacker with network access to the target device's Modbus TCP service on port 502 can exploit this vulnerability through the following mechanism:
- The attacker establishes a TCP connection to port 502 on the target DIRIS Digiware M-70 device
- A single Modbus TCP request is sent using function code 6 (Write Single Register)
- The request targets register 4352 with a value of 1
- This write operation changes the Modbus address to 15
- The device enters a denial-of-service state, becoming unresponsive to legitimate Modbus communications
The attack requires no authentication, no user interaction, and can be executed with a single network packet. The vulnerability is particularly concerning in industrial environments where Modbus devices are often deployed on flat networks with minimal segmentation.
Detection Methods for CVE-2025-54849
Indicators of Compromise
- Unexpected Modbus TCP traffic to port 502 from unauthorized IP addresses
- Modbus Write Single Register (function code 6) requests targeting register 4352
- DIRIS Digiware M-70 devices becoming unresponsive or failing to report monitoring data
- Modbus address configuration changes detected in device logs or management interfaces
- Network traffic patterns showing single Modbus TCP packets followed by device communication failures
Detection Strategies
Organizations should implement network-based detection to identify exploitation attempts targeting this vulnerability. Key detection approaches include:
Network Traffic Analysis: Monitor Modbus TCP traffic on port 502 for Write Single Register requests (function code 6) targeting register 4352. Any attempt to write to this register from an unauthorized source should trigger an alert.
Industrial Protocol Deep Packet Inspection: Deploy industrial-aware intrusion detection systems capable of parsing Modbus TCP protocols and identifying anomalous register write operations to critical configuration registers.
Behavioral Monitoring: Establish baselines for normal Modbus communication patterns and alert on deviations, particularly unexpected write operations to configuration registers.
Monitoring Recommendations
Network Segmentation Verification: Continuously monitor and verify that industrial control system networks, including devices running Modbus services, are properly segmented from general enterprise networks and the internet.
Device Health Monitoring: Implement automated monitoring of DIRIS Digiware M-70 device health and responsiveness. Alert on any devices that become unresponsive or exhibit communication failures.
Log Aggregation: Collect and analyze logs from network devices, firewalls, and industrial control systems to identify patterns indicative of reconnaissance or exploitation attempts targeting Modbus services.
SentinelOne Singularity Platform: Organizations utilizing SentinelOne can leverage the platform's network visibility capabilities to monitor for anomalous traffic patterns targeting industrial devices and detect potential exploitation attempts in real-time.
How to Mitigate CVE-2025-54849
Immediate Actions Required
- Isolate affected DIRIS Digiware M-70 devices from untrusted network segments immediately
- Implement firewall rules to restrict Modbus TCP port 502 access to authorized management systems only
- Deploy network segmentation to separate industrial control devices from general enterprise networks
- Monitor for exploitation attempts using network intrusion detection systems with Modbus protocol awareness
- Review and audit all devices running firmware version 1.6.9 for signs of compromise
- Disable Modbus TCP functionality if not operationally required
Patch Information
Consult the Cisco Talos vulnerability report (TALOS-2025-2248) and Socomec for official patch availability and firmware update instructions. Organizations should prioritize applying vendor-supplied security updates as soon as they become available.
Reference: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2248
Workarounds
In the absence of an official patch, organizations should implement the following compensating controls to reduce exposure:
Network Segmentation: Place DIRIS Digiware M-70 devices on isolated network segments with strict access controls. Industrial control devices should never be directly accessible from general enterprise networks or the internet.
Firewall Rules: Configure perimeter and internal firewalls to restrict access to Modbus TCP port 502 only from authorized management stations and monitoring systems.
VPN Access: Require VPN connections for any remote access to industrial control network segments containing vulnerable devices.
Application Layer Firewalls: Deploy industrial protocol-aware firewalls capable of inspecting Modbus traffic and blocking unauthorized write operations to sensitive registers.
# Example iptables rules to restrict Modbus TCP access
# Allow Modbus TCP (port 502) only from authorized management station
iptables -A INPUT -p tcp --dport 502 -s 192.168.100.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 502 -j DROP
# Log and drop all other Modbus TCP connection attempts
iptables -A INPUT -p tcp --dport 502 -j LOG --log-prefix "MODBUS_BLOCKED: "
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
