Cyber Posture

CVE-2025-26858

High

Published: 01 December 2025

Published
01 December 2025
Modified
05 December 2025
KEV Added
Patch
CVSS Score 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS Score 0.0009 26.2th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Security Summary

CVE-2025-26858 is a buffer overflow vulnerability in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 version 1.6.9. A specially crafted set of network packets can trigger the issue, leading to denial of service. The vulnerability is categorized under CWE-20 (Improper Input Validation) and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).

An attacker with network access can exploit this vulnerability by sending a sequence of unauthenticated packets, requiring no privileges, user interaction, or special conditions beyond low-complexity network reachability. Successful exploitation results in high-impact denial of service due to the changed scope, disrupting availability without affecting confidentiality or integrity.

Advisories providing further details, including potential mitigations, are available from Talos Intelligence at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2152 and from Socomec at https://www.socomec.fr/sites/default/files/2025-10/CVE-2025-26858---Diris-Digiware-Mxx-Dxx-_VULNERABILITIES_2025-10-01-16-38-44_English_0.pdf.

Details

CWE(s)
CWE-20

Affected Products

socomec
diris m-70 firmware
1.6.9

MITRE ATT&CK Enterprise Techniques

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Buffer overflow in Modbus TCP service enables unauthenticated remote denial of service via application exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References