CVE-2025-54851
BaseFortify
Publication date: 2025-12-01
Last updated on: 2025-12-05
Assigner: Talos
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| socomec | diris_m-70_firmware | 1.6.9 |
| socomec | diris_m-70 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a denial of service issue in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 version 1.6.9. An attacker can send a specially crafted, unauthenticated Modbus TCP message to port 503 using the Write Single Register function code (6) to write the value 1 to register 4352. This causes the device's Modbus address to change to 15, which puts the device into a denial-of-service state, making it unresponsive to legitimate requests.
How can this vulnerability impact me? :
This vulnerability can impact you by causing a denial-of-service condition on the affected device, Socomec DIRIS Digiware M-70 1.6.9. An attacker can disrupt the normal operation of the device by sending a single crafted Modbus TCP message, rendering the device unresponsive and potentially interrupting any services or processes that rely on it.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring network traffic for Modbus TCP messages sent to port 503 that use the Write Single Register function code (6) targeting register 4352 with the value 1. A command such as using tcpdump or Wireshark to filter for Modbus TCP packets on port 503 and inspecting for this specific write operation can help detect attempts to exploit this vulnerability. For example, a tcpdump command could be: tcpdump -i <interface> tcp port 503 and then analyzing packets for function code 6 writing value 1 to register 4352.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting network access to port 503 to trusted hosts only, implementing network segmentation to isolate the affected device, and monitoring for suspicious Modbus TCP traffic. Since the vulnerability is triggered by unauthenticated packets, applying firewall rules to block unauthorized Modbus TCP traffic and disabling Modbus TCP access if not needed are recommended. Additionally, contacting the vendor for patches or updates is advised.