The Socomec DIRIS Digiware M-70 is an energy monitoring gateway used in critical environments such as data centers, industrial facilities, and commercial buildings. Its primary function is to provide real-time visibility into electrical systems, making it a key component for operational stability and energy management. A failure or compromise of this device can prevent operators from detecting critical events, risking equipment damage or widespread outages.

The primary risk is a complete device takeover without authentication. An attacker with network access can first render the device unusable, creating a denial-of-service condition that can mask subsequent actions. The vulnerability then allows the attacker to reset administrative credentials to factory defaults, gaining full control. This is extremely serious in OT (Operational Technology) networks, where the device could be used as a foothold for more extensive attacks.

Although there are no confirmed reports of active exploitation, a public exploit is available, significantly increasing the likelihood of attacks. This vulnerability is not yet listed in CISA’s KEV (Known Exploited Vulnerabilities) catalog. Any organization using this device with the Modbus service exposed on the network should consider it a critical threat.

Technical Summary

The vulnerability resides in the Modbus RTU over TCP service on the Socomec DIRIS Digiware M-70 device. The root cause is a flaw in input validation (similar to CWE-20: Improper Input Validation) in the code that parses Modbus packets. The service does not correctly handle a specially malformed packet, causing state corruption that triggers a system error.

The attack unfolds in the following sequence:

1. An unauthenticated attacker sends a single, specially crafted Modbus packet to the device’s listening port (typically TCP/502).
2. The device’s network stack forwards the packet to the Modbus service for processing. The service fails to validate the packet structure, causing an unhandled exception.
3. This exception triggers an error condition that erroneously initiates a “factory reset” routine as a protection measure. This routine not only reboots the device, causing a Denial of Service, but also restores all configurations, including user credentials, to default values.
4. Once rebooted, the attacker can authenticate with the well-known default administrative credentials and gain full control of the device.

An attacker can exploit this access to manipulate energy monitoring data, disable alarms, or use the device as a persistent access point to attack other critical systems in the OT network. All firmware versions prior to the patched version are considered vulnerable. The vendor has published a security advisory and firmware updates to resolve the issue.

Recommendations

• Immediate Patching: Update the device firmware to the latest version released by Socomec that explicitly addresses CVE-2025-20085.
• Mitigations:
  • Implement strict network segmentation to isolate OT networks from corporate IT networks and the Internet.
  • Use a firewall or Access Control Lists (ACLs) to restrict access to the Modbus TCP port (502/TCP) only to trusted management stations and authorized personnel.

• Threat Hunting and Monitoring:
  • Monitor network logs for suspicious connection attempts or malformed packets directed at the Modbus TCP port on vulnerable devices.
  • Check device logs for indicators of compromise, such as unexpected reboots, configuration changes, or log entries indicating a factory reset.
  • Actively monitor for any authentication attempts using factory credentials. If detected, treat them as a confirmed compromise.

• Incident Response:
  • In case of suspected compromise, immediately isolate the affected device from the network to prevent lateral movement.
  • Perform a full firmware update and securely reset all credentials, ensuring that new passwords are neither default nor easily guessable.
  • Analyze logs and network traffic packets to determine the extent of the breach.

• Defense in Depth:
  • Enforce a policy requiring the change of default credentials on all network-enabled devices, particularly in OT environments, during the initial commissioning process.
  • Maintain regular backups of device configurations to allow for rapid restoration in the event of a reset or compromise.