A critical denial of service vulnerability in Socomec DIRIS Digiware M-70 devices allows unauthenticated remote attackers to render the device unresponsive via simple Modbus register manipulation.

This vulnerability stems from missing authentication for critical functions (CWE-306). An unauthenticated attacker can send a single Modbus TCP message to port 503, specifically utilizing the Write Single Register function code, to modify the device Modbus address and trigger a persistent denial of service state.

The ability for an unauthenticated remote attacker to cause a denial of service on industrial communication hardware poses a significant risk to operational continuity. While the CVSS score of 7.5 reflects a High severity, the impact is localized to the availability of the affected device, potentially causing secondary process disruptions in environments relying on Modbus communication. Unauthorized modification of device registers can lead to extended system downtime and require manual intervention to restore functionality.

Immediate Action: Restrict network access to the Modbus port 503 to authorized systems only, as no firmware patch is currently confirmed available.

Proactive Monitoring: Monitor network traffic for anomalous Modbus function code 6 (Write Single Register) requests directed at the DIRIS Digiware M-70, particularly those targeting register 4352.

Compensating Controls: Implement network segmentation and firewall rules to ensure that only trusted HMI or PLC controllers can communicate with the device over the Modbus protocol.

Public Exploit Available: No (no confirmed public exploit available).

Given the ease with which this denial of service condition can be triggered, organizations must prioritize isolating affected Socomec devices from public or untrusted network segments. Until a vendor-supplied firmware update is verified and applied, strict network access control lists are the primary defense against this vulnerability.