What is the CVSS score of CVE-2024-49572?

CVE-2024-49572 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Diris M 70 Firmware are affected by CVE-2024-49572?

A critical vulnerability in Socomec DIRIS Digiware M-70 power monitoring devices (version 1.6.9) allows unauthenticated attackers to disable affected systems and reset them to default credentials,…

How to fix or mitigate CVE-2024-49572?

Within 24 hours: Inventory all Socomec DIRIS Digiware M-70 devices in your environment and verify affected versions; isolate vulnerable devices from untrusted networks where possible. Within 7 days: Implement network-level restrictions limiting Modbus TCP access (port 502) to authorized systems only; change all default credentials on affected devices immediately and enforce strong, unique passwords. Within 30 days: Monitor Socomec security advisories for patch availability; evaluate replacement or upgrade options; conduct network segmentation review to prevent lateral movement from compromised devices.

Diris M 70 Firmware CVE-2024-49572

EUVD-2024-55109 HIGH

Missing Authentication for Critical Function (CWE-306)

2025-12-01 talos-cna@cisco.com

Authentication Bypass Denial Of Service Diris M 70 Firmware

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 13:34 euvd

EUVD-2024-55109

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

CVE Published

Dec 01, 2025 - 16:15 nvd

HIGH 7.2

DescriptionCVE.org

A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to denial of service and weaken credentials resulting in default documented credentials being applied to the device. An attacker can send an unauthenticated packet to trigger this vulnerability.

Analysis

Technical ContextAI

An authentication bypass vulnerability allows attackers to circumvent login mechanisms and gain unauthorized access without valid credentials. This vulnerability is classified as Missing Authentication for Critical Function (CWE-306).

RemediationAI

Implement robust authentication mechanisms. Use multi-factor authentication. Review authentication logic for bypass conditions. Remove default credentials.