CVE-2025-54850 Overview
CVE-2025-54850 is a denial of service vulnerability in the Socomec DIRIS Digiware M-70 power monitoring device running firmware version 1.6.9. The flaw resides in the Modbus TCP and Modbus RTU over TCP functionality exposed on port 503. An unauthenticated remote attacker can send a crafted sequence of Modbus write requests to change the device's Modbus address, which places the device into a denial-of-service state. The vulnerability is tracked under [CWE-306] Missing Authentication for Critical Function and was disclosed by Cisco Talos.
Critical Impact
Unauthenticated attackers on the network can permanently disrupt power monitoring operations on Socomec DIRIS Digiware M-70 devices by sending three Modbus write requests over TCP.
Affected Products
- Socomec DIRIS Digiware M-70 firmware version 1.6.9
- Socomec DIRIS Digiware M-70 hardware
- Deployments exposing Modbus RTU over TCP on port 503
Discovery Timeline
- 2025-12-01 - CVE-2025-54850 published to the National Vulnerability Database
- 2025-12-05 - Last updated in NVD database
Technical Details for CVE-2025-54850
Vulnerability Analysis
The Socomec DIRIS Digiware M-70 exposes Modbus RTU over TCP on port 503 without authentication. The Modbus protocol implementation accepts Write Single Register requests (function code 6) from any network client. Three specific registers control the device's Modbus address configuration and accept writes without verifying the requester's identity or session state. An attacker chaining these writes can reconfigure the device into an unresponsive state.
Because the affected service is reachable over the network and requires no privileges or user interaction, exploitation is straightforward in environments where Modbus traffic is not segregated. The result is loss of availability for the power monitoring functions, which can disrupt visibility into electrical distribution systems in industrial and commercial deployments.
Root Cause
The root cause is missing authentication on a security-critical configuration function [CWE-306]. The Modbus interface treats configuration registers as freely writable and does not enforce any authorization check before committing changes to the device's communication identity. Modbus itself does not provide authentication primitives, and the vendor implementation did not add a compensating control around configuration-changing register writes.
Attack Vector
The attacker establishes a TCP connection to port 503 on the target device and issues three Modbus Write Single Register messages in sequence. The first message writes the value 1000 to register 58112, signaling that a configuration change will follow. The second message writes the new Modbus address to register 29440. The third message writes the value 161 to register 57856, committing the configuration change. After the commit, the device enters a denial-of-service state and stops responding normally to Modbus polling. No credentials, prior access, or user interaction are required.
Detection Methods for CVE-2025-54850
Indicators of Compromise
- Modbus TCP traffic to port 503 on Socomec DIRIS Digiware M-70 devices originating from unexpected source addresses
- Write Single Register (function code 6) messages targeting registers 58112, 29440, or 57856
- Sudden loss of Modbus polling responses from a DIRIS M-70 device that was previously reachable
- Unexpected changes to the configured Modbus slave address on the device
Detection Strategies
- Deploy passive operational technology (OT) network monitoring to inspect Modbus function codes and target registers on traffic to port 503
- Alert on any Write Single Register operation targeting configuration registers 58112, 29440, and 57856 in close sequence
- Correlate device availability telemetry from SCADA or building management platforms with Modbus write activity preceding outages
Monitoring Recommendations
- Baseline normal Modbus client source addresses and alert on writes from unauthorized hosts
- Forward Modbus session logs and network flow records to a centralized SIEM for retention and correlation
- Continuously monitor DIRIS M-70 device responsiveness and configuration drift against a known-good baseline
How to Mitigate CVE-2025-54850
Immediate Actions Required
- Restrict network access to TCP port 503 on all DIRIS Digiware M-70 devices to a defined allowlist of engineering workstations and SCADA hosts
- Place affected devices behind an industrial firewall or data diode that enforces Modbus function code and register filtering
- Inventory all Socomec DIRIS Digiware M-70 units and confirm firmware versions to identify exposure to firmware 1.6.9
- Coordinate with Socomec support for updated firmware that addresses the missing authentication condition
Patch Information
No vendor patch is referenced in the NVD entry at publication time. Refer to the Talos Intelligence Vulnerability Report TALOS-2025-2248 for the latest vendor coordination status and any released firmware updates.
Workarounds
- Segment OT networks so Modbus port 503 is not reachable from corporate or untrusted networks
- Configure firewall rules to permit Modbus TCP only from authorized polling servers
- Disable Modbus RTU over TCP on devices that do not require it, or restrict it to a dedicated management VLAN
- Monitor for and block Write Single Register requests to configuration registers 58112, 29440, and 57856 at the network boundary
# Example iptables rule restricting Modbus port 503 to an authorized SCADA host
iptables -A INPUT -p tcp --dport 503 -s 10.10.20.5 -j ACCEPT
iptables -A INPUT -p tcp --dport 503 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
