Executive Summary

This vulnerability is a denial of service issue in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 version 1.6.9. An attacker can send a specially crafted, unauthenticated Modbus TCP message to port 503 using the Write Single Register function code (6) to write the value 1 to register 4352. This causes the device's Modbus address to change to 15, which puts the device into a denial-of-service state, making it unresponsive to legitimate requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a denial-of-service condition on the affected device, Socomec DIRIS Digiware M-70 1.6.9. An attacker can disrupt the normal operation of the device by sending a single crafted Modbus TCP message, rendering the device unresponsive and potentially interrupting any services or processes that rely on it.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring network traffic for Modbus TCP messages sent to port 503 that use the Write Single Register function code (6) targeting register 4352 with the value 1. A command such as using tcpdump or Wireshark to filter for Modbus TCP packets on port 503 and inspecting for this specific write operation can help detect attempts to exploit this vulnerability. For example, a tcpdump command could be: tcpdump -i <interface> tcp port 503 and then analyzing packets for function code 6 writing value 1 to register 4352.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting network access to port 503 to trusted hosts only, implementing network segmentation to isolate the affected device, and monitoring for suspicious Modbus TCP traffic. Since the vulnerability is triggered by unauthenticated packets, applying firewall rules to block unauthorized Modbus TCP traffic and disabling Modbus TCP access if not needed are recommended. Additionally, contacting the vendor for patches or updates is advised.

Useful 0 Not Useful 0