⚡ Critical IIoT Power Meter Vulnerabilities Could Crash Energy Monitoring Systems
Industrial infrastructure rarely gets the spotlight — until something breaks.
Security researchers have discovered six denial-of-service (DoS) vulnerabilities in the Socomec DIRIS M-70 IIoT power monitoring gateway, a device widely used in critical environments like data centers, hospitals, and energy infrastructure.
These flaws could allow attackers on the network to crash the device remotely, disrupting power monitoring and potentially interfering with energy management systems.
The vulnerabilities have now been patched, but the research behind the discovery reveals something even more interesting: a new way to analyze locked-down industrial devices.
🏭 What the DIRIS M-70 Actually Does
The Socomec DIRIS M-70 isn’t just another IoT gadget.
It acts as a central gateway for energy monitoring systems, aggregating power data from connected devices and communicating with management systems using industrial protocols.
The gateway supports:
Modbus RTU
Modbus TCP
BACnet IP
SNMP
These protocols allow it to integrate into building automation, energy management platforms, and industrial control environments.
Because the gateway sits at the center of power telemetry systems, a failure can disrupt monitoring across entire facilities.
🔐 Hardware Security Roadblock
Initial attempts to analyze the device hit a wall.
The gateway runs on an STM32 microcontroller with Code Read-out Protection (RDP) Level 1 enabled, which prevents attackers or researchers from reading the firmware through JTAG debugging.
This security feature blocks direct memory extraction and prevents stepping through code while the device processes network traffic.
In other words, traditional hardware debugging was effectively locked out.
But researchers found another path.
🧠 A Smarter Approach: Emulate Only What Matters
Instead of emulating the entire device — a complex and resource-heavy process — researchers focused on one specific component:
The Modbus protocol processing thread.
This thread is responsible for handling more than 700 potential message types, making it a rich attack surface.
By isolating and emulating this single thread, researchers could test how the system handled Modbus messages without recreating the entire firmware environment.
Think of it as reverse-engineering the engine without rebuilding the whole car.
🧪 Coverage-Guided Fuzzing
To uncover vulnerabilities, researchers combined several powerful tools.
Unicorn Engine
Used to emulate the CPU instructions inside the Modbus handler.
AFL (American Fuzzy Lop)
Generated thousands of mutated network packets designed to explore different code paths.
Qiling Framework
Provided debugging tools and coverage analysis to visualize where the code executed.
Together, these tools allowed researchers to send automatically generated Modbus messages into the emulated thread and observe how the firmware responded.
When crashes occurred, they could analyze exactly where the failure happened.
💥 Six DoS Vulnerabilities Discovered
The fuzzing campaign uncovered six denial-of-service vulnerabilities affecting Modbus message processing.
The issues are tracked under the following CVEs:
CVE-2025-54848
CVE-2025-54849
CVE-2025-54850
CVE-2025-54851
CVE-2025-55221
CVE-2025-55222
Attackers could exploit these flaws by sending specially crafted Modbus TCP or Modbus RTU-over-TCP messages, causing the device to crash.
In critical environments, this could lead to:
Loss of power monitoring visibility
Disrupted energy management systems
Operational instability in industrial environments
While the attack does not allow remote code execution, service disruption alone can have major operational consequences.
🛡 Why This Research Matters
Beyond the vulnerabilities themselves, the methodology used here is important.
Industrial devices often include protections that make traditional reverse-engineering difficult.
But this research demonstrates that selective thread emulation combined with coverage-guided fuzzing can still uncover serious vulnerabilities without full hardware access.
This approach could be used to analyze other industrial systems where firmware access is restricted.
🔧 Mitigation and Remediation
Socomec has released firmware patches addressing all six vulnerabilities.
Organizations using DIRIS M-70 gateways should take the following steps immediately:
1️⃣ Apply the Latest Firmware Update
Ensure the device is running the patched firmware version.
2️⃣ Monitor Industrial Network Traffic
Deploy updated detection signatures to identify suspicious Modbus activity.
3️⃣ Segment Industrial Control Networks
Limit exposure of Modbus-enabled devices to trusted network segments.
4️⃣ Review Cisco Talos Advisories
Security teams should review the coordinated disclosure details and related detection rules.
🎯 Strategic Takeaway
Industrial IoT devices are increasingly connected to enterprise networks — and attackers know it.
Even when firmware protections block traditional reverse-engineering, creative approaches like thread-level emulation and fuzz testing can still uncover critical vulnerabilities.
For organizations operating energy and infrastructure systems, proactive patching and network segmentation remain essential.
Because in critical infrastructure, even a temporary outage can become a serious operational risk.
