CVE-2025-55221: Socomec Diris M-70 Firmware DOS Vulnerability

CVE-2025-55221 Overview

CVE-2025-55221 is a denial of service vulnerability in the Socomec DIRIS Digiware M-70 power monitoring device running firmware version 1.6.9. The flaw resides in the Modbus TCP and Modbus RTU over TCP USB Function functionality. A remote attacker can send a specially crafted Modbus packet to TCP port 502 to trigger the condition. The vulnerability requires no authentication, as classified under CWE-306: Missing Authentication for Critical Function. Successful exploitation disrupts the availability of the device, which monitors electrical distribution networks in industrial and commercial environments.

Critical Impact
Unauthenticated remote attackers can crash the Modbus service on the DIRIS Digiware M-70, disrupting power monitoring telemetry across affected industrial control system deployments.

Affected Products

Socomec DIRIS Digiware M-70 (hardware)
Socomec DIRIS Digiware M-70 Firmware version 1.6.9
Deployments exposing Modbus TCP port 502 to untrusted networks

Discovery Timeline

2025-12-01 - CVE-2025-55221 published to the National Vulnerability Database
2025-12-05 - Last updated in NVD database

Technical Details for CVE-2025-55221

Vulnerability Analysis

The DIRIS Digiware M-70 exposes Modbus TCP services on TCP port 502 and also supports tunneling Modbus RTU frames over the same TCP transport via a USB Function path. The vulnerability is reachable through the network without credentials, since the Modbus TCP specification does not define authentication for protocol-level operations. An attacker sending a malformed Modbus packet causes the device to enter a denial of service state, interrupting telemetry collection and monitoring functions in industrial control system (ICS) environments.

Root Cause

The root cause is mapped to CWE-306: Missing Authentication for Critical Function. The Modbus TCP listener accepts and processes packets from any network peer without verifying the sender. Combined with insufficient validation of message structure in the Modbus RTU over TCP USB Function handler, a single malicious packet can drive the service into an unavailable state. The Talos advisory references the malicious message vector against port 502.

Attack Vector

Exploitation requires only network reachability to the device's Modbus TCP listener. The attacker does not need credentials, prior access, or user interaction. A crafted Modbus packet sent to port 502 is sufficient to trigger the denial of service. The vulnerability is limited to availability impact; it does not provide code execution or data exposure based on the published advisory.

No verified proof-of-concept code is publicly available. See the Talos Intelligence Vulnerability Report TALOS-2025-2251 for technical details.

Detection Methods for CVE-2025-55221

Indicators of Compromise

Unexpected loss of Modbus TCP connectivity or telemetry from a DIRIS Digiware M-70 device.
Inbound TCP traffic to port 502 originating from sources outside the engineering or SCADA network.
Malformed Modbus Application Protocol (MBAP) headers or invalid function codes captured in network traffic preceding device unavailability.

Detection Strategies

Deploy ICS-aware network intrusion detection signatures that validate Modbus MBAP framing and function code compliance on port 502.
Baseline normal Modbus traffic patterns to each DIRIS M-70 and alert on protocol anomalies or unexpected client addresses.
Monitor device heartbeat and polling intervals from upstream SCADA or building management systems for sudden gaps consistent with a service crash.

Monitoring Recommendations

Forward firewall and switch logs covering Modbus segments into a centralized analytics platform for correlation against device availability events.
Enable passive ICS asset monitoring to identify firmware version 1.6.9 instances and track exposure of port 502.
Alert on any Modbus TCP session originating from corporate IT VLANs, remote-access ranges, or the public internet.

How to Mitigate CVE-2025-55221

Immediate Actions Required

Restrict TCP port 502 to authorized SCADA and engineering workstations using firewall rules or ACLs on managed switches.
Inventory all DIRIS Digiware M-70 devices and identify units running firmware 1.6.9.
Place affected devices behind an ICS-aware firewall or data diode where direct Modbus exposure is not operationally required.

Patch Information

No fixed firmware version is referenced in the public advisory at the time of publication. Consult the Talos Intelligence Vulnerability Report TALOS-2025-2251 and Socomec product support channels for updated firmware availability and remediation guidance.

Workarounds

Segment DIRIS Digiware M-70 devices into a dedicated OT VLAN with no direct routing from corporate or internet-facing networks.
Enforce allow-listing on the Modbus TCP listener so only known SCADA polling hosts can reach port 502.
Use a Modbus-aware gateway or protocol proxy to validate MBAP framing and drop malformed packets before they reach the device.
Disable Modbus RTU over TCP USB Function handling if the deployment does not require it.

bash

# Example: restrict Modbus TCP (port 502) to a SCADA host on a Linux gateway
iptables -A FORWARD -p tcp --dport 502 -s 10.20.30.40 -d 10.50.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp --dport 502 -d 10.50.0.0/24 -j DROP