SB2025120218 - Multiple vulnerabilities in Socomec DIRIS Digiware M-70

Main Vulnerability Database SB2025120218

SB2025120218 - Multiple vulnerabilities in Socomec DIRIS Digiware M-70

Published: December 2, 2025

Security Bulletin ID SB2025120218

Severity

Medium

Patch available

YES

Number of vulnerabilities 13

Exploitation vector Remote access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 13 secuirty vulnerabilities.

1) Missing Authentication for Critical Function (CVE-ID: CVE-2024-48882)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to missing authentication for critical function in the Modbus TCP functionality. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

2) Missing Authentication for Critical Function (CVE-ID: CVE-2025-20085)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to missing authentication for critical function in the Modbus RTU over TCP functionality. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

3) Buffer overflow (CVE-ID: CVE-2025-26858)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the Modbus TCP functionality. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.

4) Missing Authentication for Critical Functionh (CVE-ID: CVE-2025-23417)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to missing authentication for critical function in the Modbus RTU over TCP functionality. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

5) Missing Authentication for Critical Function (CVE-ID: CVE-2025-55221)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to missing authentication for critical function in the Modbus TCP functionality. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

6) Missing Authentication for Critical Function (CVE-ID: CVE-2025-55222)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to missing authentication for critical function in the Modbus RTU over TCP USB Function functionality. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

7) Cleartext transmission of sensitive information (CVE-ID: CVE-2024-48894)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to software uses insecure communication channel to transmit sensitive information in the WEBVIEW-M functionality. A remote attacker can gain access to sensitive data.

8) Missing Authentication for Critical Function (CVE-ID: CVE-2024-49572)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to missing authentication for critical function in the Modbus TCP functionality. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

9) Missing Authentication for Critical Function (CVE-ID: CVE-2025-54851)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to missing authentication for critical function in the Modbus TCP and Modbus RTU over TCP functionality within UPS Default settings. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

10) Missing Authentication for Critical Function (CVE-ID: CVE-2025-54850)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to missing authentication for critical function in the Modbus TCP and Modbus RTU over TCP functionality within Modbus Address modification. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

11) Missing Authentication for Critical Function (CVE-ID: CVE-2025-54849)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to missing authentication for critical function in the Modbus TCP and Modbus RTU over TCP functionality within UPS Default settings. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

12) Missing Authentication for Critical Function (CVE-ID: CVE-2025-54848)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to missing authentication for critical function in the Modbus TCP and Modbus RTU over TCP functionality within Modbus Address modification. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

13) Cross-site request forgery (CVE-ID: CVE-2024-53684)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the WEBVIEW-M functionality. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Remediation

Install update from vendor's website.

References