CVE-2025-54851: Socomec Diris M-70 Firmware DoS Vulnerability

CVE-2025-54851 Overview

A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 firmware version 1.6.9. This vulnerability allows an unauthenticated attacker to render the device inoperable by sending a specially crafted series of network requests. The attack exploits the lack of authentication on the Modbus protocol interface, enabling remote attackers to disrupt industrial monitoring and power management operations.

Critical Impact
An unauthenticated remote attacker can completely disable the Socomec DIRIS M-70 device by sending a single Modbus TCP message, potentially disrupting critical power monitoring infrastructure in industrial environments.

Affected Products

Socomec DIRIS Digiware M-70 Firmware version 1.6.9
Socomec DIRIS M-70 Hardware

Discovery Timeline

2025-12-01 - CVE-2025-54851 published to NVD
2025-12-05 - Last updated in NVD database

Technical Details for CVE-2025-54851

Vulnerability Analysis

This vulnerability stems from missing authentication controls (CWE-306) in the Modbus TCP implementation of the Socomec DIRIS M-70 power monitoring device. The device exposes a Modbus TCP service on port 503 that accepts commands without requiring authentication. An attacker can exploit this weakness to modify critical device configuration registers, specifically altering the Modbus address and placing the device into an unresponsive denial-of-service state.

The attack is trivial to execute and requires only a single malformed packet. Once the Modbus address is changed to an unexpected value (address 15), the device becomes inaccessible to legitimate monitoring systems that attempt to communicate with it at its original address. This could have significant implications for power monitoring and industrial control environments where continuous device availability is critical.

Root Cause

The root cause is the absence of authentication mechanisms (CWE-306: Missing Authentication for Critical Function) on the Modbus TCP interface. The device accepts and processes Write Single Register commands from any network source without verifying the identity or authorization of the requesting party. This design flaw allows unauthenticated users to modify sensitive device configuration parameters, including the Modbus communication address stored in register 4352.

Attack Vector

The attack is executed over the network and requires no authentication or user interaction. An attacker sends a Modbus TCP message to port 503 using function code 6 (Write Single Register) to write the value 1 to register 4352. This single packet modifies the device's Modbus address to 15, causing it to stop responding to requests at its original address. The device enters a denial-of-service state that persists until manual intervention restores the correct configuration.

The attack sequence involves:

Connecting to the target device on TCP port 503
Sending a Write Single Register (function code 6) Modbus TCP frame
Targeting register 4352 with value 1
The device Modbus address changes to 15, rendering it unresponsive to normal operations

For detailed technical information, refer to the Talos Intelligence Vulnerability Report.

Detection Methods for CVE-2025-54851

Indicators of Compromise

Unexpected Modbus TCP traffic targeting port 503 on DIRIS M-70 devices
Modbus Write Single Register commands (function code 6) targeting register 4352
Sudden loss of communication with DIRIS M-70 devices on the network
Device reporting an unexpected Modbus address of 15 instead of the configured value

Detection Strategies

Implement network monitoring to detect Modbus TCP traffic on port 503 from unauthorized sources
Configure IDS/IPS rules to alert on Write Single Register commands targeting register 4352 on DIRIS M-70 devices
Monitor for anomalous Modbus function code 6 packets originating from outside trusted management networks
Deploy industrial protocol-aware network monitoring solutions that can inspect Modbus TCP payloads

Monitoring Recommendations

Establish baseline Modbus communication patterns and alert on deviations
Implement SIEM rules to correlate Modbus TCP connection attempts with device availability metrics
Monitor device health dashboards for sudden offline events affecting DIRIS M-70 units
Configure alerts for any changes to device Modbus address configuration

How to Mitigate CVE-2025-54851

Immediate Actions Required

Isolate affected Socomec DIRIS M-70 devices from untrusted network segments immediately
Implement firewall rules to restrict Modbus TCP port 503 access to authorized management hosts only
Deploy network segmentation to place industrial monitoring devices on protected VLAN segments
Review and audit all network access paths to affected devices

Patch Information

Consult the Talos Intelligence Vulnerability Report for the latest patch availability and vendor remediation guidance from Socomec. Organizations should contact Socomec directly to obtain firmware updates that address this vulnerability.

Workarounds

Implement strict network access controls to limit Modbus TCP connections to trusted management stations only
Deploy a firewall or industrial security appliance to filter unauthorized Modbus commands before they reach devices
Consider deploying a Modbus-aware application firewall that can block Write Single Register commands to sensitive registers
Disable remote Modbus TCP access if not required for operational purposes and use local configuration methods instead

bash

# Example firewall rule to restrict Modbus TCP access (iptables)
# Allow only trusted management IP to access Modbus port 503
iptables -A INPUT -p tcp --dport 503 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 503 -j DROP