CVE-2025-54851CWE-306

CVE-2025-54851

High · published December 1, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

⚡ Just one crafty message is all it takes to send the Socomec DIRIS Digiware M-70 into a denial-of-service tailspin! 🔥 Think of this vulnerability like a single prank call that causes a busy restaurant to freeze up — the moment someone dials that one specific number, the whole place can’t take any more orders. It's a simple action that leads to chaos. An attacker could disrupt operations by sending a single Modbus TCP message, leaving the device completely unresponsive. This denial-of-service condition could halt critical monitoring and control functions, potentially leading to significant downtime. The effects can be particularly devastating in environments where reliability is key.

Put simply

Think of this vulnerability like a single prank call that causes a busy restaurant to freeze up — the moment someone dials that one specific number, the whole place can’t take any more orders. It's a simple action that leads to chaos. This vulnerability resides in the Modbus TCP and Modbus RTU over TCP functionality, where an attacker can trigger a denial-of-service by sending a specific packet sequence to port 503, altering the Modbus address and causing the device to crash.

What to do

An attacker could disrupt operations by sending a single Modbus TCP message, leaving the device completely unresponsive. This denial-of-service condition could halt critical monitoring and control functions, potentially leading to significant downtime. The effects can be particularly devastating in environments where reliability is key. To protect your systems, you should patch the Socomec DIRIS Digiware M-70 to version 1.6.10 or higher immediately. Additionally, consider implementing network access controls to restrict unauthenticated packets from reaching sensitive devices. Regularly review your network configurations to ensure robust security. You've got this! Follow these steps, and you'll have your defenses in place in no time. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-12-01T21:15Z
Affected products (1)
ProductVersionsFixed in
socomec/diris_m-70_firmwareall versions—
References (1)
EPSS history
Timeline
  • 01 DEC 15:25Z
    A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9
    cvelistv5