Socomec DIRIS Digiware M-70 1.6.9 (Modbus TCP and Modbus RTU-over-TCP): A large cluster of unauthenticated Modbus

Impact

A large cluster of unauthenticated Modbus denial-of-service and buffer-overflow issues in a device that sits on the electrical monitoring backbone - and two of them do something worse than crash: the DoS also weakens credentials such that the documented default credentials become valid on the device again. That converts a crash into an authentication bypass, which is a genuinely nasty combination on gear that monitors and in some deployments controls electrical distribution. Losing the Digiware monitoring layer blinds the operator to power conditions across the hall during whatever else the attacker is doing, and a device that has silently reverted to default credentials is a persistent foothold in the electrical segment. The Modbus angle is the general lesson here: these are unauthenticated packets to TCP 502, and the same class of embedded Modbus stack fragility exists across chiller, CDU and ATS controllers throughout the facility.

Who can reach it

Unauthenticated network packets to the device's Modbus TCP service - Talos confirms a single crafted packet suffices for several of these. No credentials, no interaction. The device lives on the facility/electrical VLAN, typically polled by the BMS or a DCIM collector, and is often reachable from any host on that segment because Modbus deployments almost never carry ACLs.

What to do

Firmware update from Socomec for the DIRIS Digiware M-70. That is a per-device flash on live electrical monitoring gear, coordinated with the electrical contractor - not a cooling outage, but still a scheduled window and a technician per device. Because credential reversion is in scope, after patching you must re-verify that default credentials no longer work on every unit, not just assume the update handled it. The durable control is the Modbus one: default-deny on TCP 502, permit only the poller, and alert on any Modbus write function code appearing on a segment that should only see reads.

References