An unauthenticated remote denial of service vulnerability in Socomec DIRIS Digiware M-70 allows attackers to disable device functionality through a specific sequence of Modbus packets.

This vulnerability is caused by missing authentication for critical function (CWE-306), allowing an unauthenticated attacker to send crafted Modbus TCP messages to port 502. By sending a specific sequence of write commands to registers 58112, 29440, and 57856, the attacker can force the device into a persistent denial of service state.

The ability for an unauthenticated attacker to remotely disrupt the operation of critical power monitoring equipment poses a significant risk to operational continuity. Successful exploitation results in a complete loss of service for the affected device, potentially impacting industrial control systems and facility monitoring capabilities. Given the CVSS score of 7.5, this high severity flaw requires immediate attention to prevent unauthorized disruption.

Immediate Action: Restrict network access to port 502 to authorized IP addresses only, as no vendor patch is currently confirmed for this specific version.

Proactive Monitoring: Monitor network traffic for unusual Modbus communication patterns, particularly sequential writes to registers 58112, 29440, and 57856 directed at the M-70 device.

Compensating Controls: Implement industrial firewalls or deep packet inspection (DPI) solutions capable of filtering and blocking unauthorized Modbus function codes and specific register modifications.

Public Exploit Available: Unknown.

Due to the critical nature of industrial monitoring hardware, organizations should treat this vulnerability with high urgency. Until a vendor-supplied firmware update is available, network segmentation and strict access control lists for Modbus traffic are the most effective methods to mitigate the risk of remote service disruption.