CVE-2025-54850CWE-306

CVE-2025-54850

High · published December 1, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
23.9
In the wild
Unconfirmed
What it is

🚨 A crafty sequence of Modbus packets is all it takes to bring the Socomec DIRIS Digiware M-70 to its knees! ⚡ Think of it like trying to enter a party by giving the bouncer an incorrect password three times in a row. Each wrong attempt leads to being locked out entirely, just like these specially crafted requests leave the device in a denial-of-service state! If exploited, an attacker could effectively lock you out of the device, causing significant disruption to operations. This denial-of-service vulnerability could halt monitoring and control functions, leading to absolutely devastating consequences for your system's reliability and performance. Who wants to deal with a party where no one's allowed in? 😱

Put simply

Think of it like trying to enter a party by giving the bouncer an incorrect password three times in a row. Each wrong attempt leads to being locked out entirely, just like these specially crafted requests leave the device in a denial-of-service state! This denial of service vulnerability lies in the Modbus TCP and Modbus RTU over TCP functionality of the Socomec DIRIS Digiware M-70 version 1.6.9. By sending a sequence of crafted messages to port 503 using the Write Single Register function, an attacker can trigger a denial-of-service condition by manipulating device configurations.

What to do

If exploited, an attacker could effectively lock you out of the device, causing significant disruption to operations. This denial-of-service vulnerability could halt monitoring and control functions, leading to absolutely devastating consequences for your system's reliability and performance. Who wants to deal with a party where no one's allowed in? 😱 Immediately patch your Socomec DIRIS Digiware M-70 to version 1.6.10 or later to address this vulnerability. Additionally, implement network filtering rules to restrict access to port 503, and monitor for any unusual traffic that could indicate an attempt to exploit this flaw. You've got this! With these steps, you can secure your device and hold onto your superhero status! 🦸‍♂️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00321 · 23.9th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-12-01T21:15Z
Affected products (1)
ProductVersionsFixed in
socomec/diris_m-70_firmwareall versions—
References (1)
EPSS history
Timeline
  • 01 DEC 15:25Z
    A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9
    cvelistv5