Overview
CVE-2025-23417 is a high-severity denial of service (DoS) vulnerability affecting Socomec DIRIS Digiware M-70 version 1.6.9. The vulnerability resides within the Modbus RTU over TCP functionality of the device. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted network packet, leading to a denial of service condition.
Technical Details
The vulnerability stems from improper handling of specific network packets within the Modbus RTU over TCP implementation. By sending a malformed or unexpected packet, an attacker can cause the DIRIS Digiware M-70 device to crash or become unresponsive. The lack of authentication required to trigger the vulnerability significantly increases the attack surface.
CVSS Analysis
- CVSS Score: 8.6 (High)
- CVSS Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Explanation: This CVSS score indicates a high-severity vulnerability. The attack vector is network-based (AV:N), requiring no special access privileges (PR:N) or user interaction (UI:N). The attack complexity is low (AC:L), making it relatively easy to exploit. The impact is a denial of service (A:H), meaning the device becomes unavailable.
Possible Impact
Successful exploitation of this vulnerability can have significant consequences:
- Loss of Monitoring Capabilities: The DIRIS Digiware M-70 device will be unavailable, leading to a loss of power monitoring and control capabilities.
- Operational Disruptions: In critical infrastructure environments, this could lead to disruptions in industrial processes and potential equipment damage.
- Economic Losses: Downtime and recovery efforts can result in significant financial losses for affected organizations.
Mitigation and Patch Steps
The following mitigation steps are recommended to address this vulnerability:
- Apply the Patch: Upgrade to a patched version of the Socomec DIRIS Digiware M-70 firmware. Contact Socomec support for the latest available patch.
- Network Segmentation: Isolate the DIRIS Digiware M-70 device on a separate network segment to limit the potential impact of a successful attack.
- Access Control Lists (ACLs): Implement ACLs to restrict network traffic to and from the device, allowing only authorized connections.
- Intrusion Detection Systems (IDS): Deploy an IDS to monitor network traffic for malicious activity and alert administrators to potential attacks.
