Researchers Uncover DoS Vulnerabilities in Socomec DIRIS M-70 IIoT Power Meter via Thread Emulation & Fuzzing
Recent vulnerability research has identified six denial-of-service (DoS) vulnerabilities in the Socomec DIRIS M-70 IIoT power-monitoring gateway. These vulnerabilities have now been addressed following Cisco’s Coordinated Disclosure Policy.
Recent vulnerability research has identified six denial-of-service (DoS) vulnerabilities in the Socomec DIRIS M-70 IIoT power-monitoring gateway. These vulnerabilities have now been addressed following Cisco’s Coordinated Disclosure Policy.
The Socomec DIRIS M-70 gateway functions as a central communications node for energy monitoring, supporting RS485 and Ethernet, as well as protocols such as Modbus RTU, Modbus TCP, BACnet IP, and SNMP. It is widely used in sectors including data centers, healthcare, and energy infrastructure.
The device runs the µC/OS-III RTOS and exposes multiple industrial protocols, increasing its attack surface. Hardware debugging was initially challenged by the STM32 microcontroller's Code Read-out Protection (RDP) Level 1, which restricts flash reads and prevents single-stepping through live code paths.
A Cisco Talos researcher circumvented these limitations by emulating the Modbus handling thread, demonstrating that partial emulation can lead to significant vulnerability discoveries.
Recent vulnerability research has identified six denial-of-service (DoS) vulnerabilities in the Socomec DIRIS M-70 IIoT power-monitoring gateway.
The research utilized the Unicorn Engine to build a CPU-level emulator, focusing on the Modbus protocol processing thread. This setup allowed for the integration of AFL for coverage-guided fuzzing, enabling the generation of diverse Modbus messages that explore various code paths without full system emulation.
Unicorn’s integration with AFL facilitated debugging workflows, such as breakpoints and stack analysis. The setup was further enhanced by porting it to the Qiling framework, which added debugging and code coverage capabilities.
The fuzzing efforts uncovered multiple Modbus message types that could reliably crash the device, leading to six DoS vulnerabilities. These are identified as CVE-2025-54848 through CVE-2025-54851 under report TALOS-2025-2248, and CVE-2025-55221 and CVE-2025-55222 under TALOS-2025-2251.
These vulnerabilities affect Modbus TCP and Modbus RTU over TCP handling, potentially allowing remote attackers to disrupt power monitoring or management operations.
All identified vulnerabilities have been disclosed to Socomec, and patches have been released for the affected firmware versions. Organizations using DIRIS M-70 gateways in critical infrastructure are advised to update to the latest firmware, review Cisco Talos advisories, and deploy updated Snort rules to detect exploitation attempts over Modbus channels.
Based on reporting by GBHackers.