CVE-2024-48894: Socomec DIRIS Digiware M-70 Cleartext Transmission Vulnerability

Vulnerability Key Information Basic Information Report Number: TALOS-2024-2115 CVE Number: CVE-2024-48894 Release Date: December 1, 2024 Vulnerability Overview Vulnerability Name: Socomec DIRIS Digiware M-70 WEBVIEW-M cleartext transmission vulnerability Vulnerability Description: The WEBVIEW-M feature in Socomec DIRIS Digiware M-70 contains a cleartext transmission vulnerability. Specifically crafted HTTP requests may lead to sensitive information leakage. Attackers can trigger this vulnerability by eavesdropping on network traffic. Affected Versions Confirmed Vulnerable Version: Socomec DIRIS Digiware M-70 1.6.9 Assessment Information CVSSv3 Score: 5.9 - CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CWE Number: CWE-319 - Cleartext Transmission of Sensitive Information Details Product Information: DIRIS Digiware M-70 - https://www.socomec.us/en-us/reference/48290222 Vulnerability Description: The DIRIS Digiware M-50/M-70 gateway serves as an access point for industrial power monitoring systems, providing power and communication connections to devices within electrical installations. It also includes a WEBVIEW-M web server for remote visualization and analysis of measurement and consumption data. - Network Communication: By default, network communication with the Socomec M70 web server does not use encryption. Sensitive information—including credentials, session cookies, and configuration data—is transmitted in cleartext between the browser and the WEBVIEW-M service. Attackers can exploit this cleartext data to hijack authenticated sessions or capture valid credentials, thereby gaining access to the device. Mitigation Measures Recommended Action: Enable HTTPS communication for the WEBVIEW-M web server. Vendor Response Vendor Advisory: https://www.socomec.fr/sites/default/files/2025-11/CVE-2024-48894-Diris-Digiware-Webview_VULNERABILITIES_2025-11-03-16-36-40_English.pdf Timeline Vendor Disclosure: January 13, 2025 Vendor Patch Release: November 3, 2025 Public Release: December 1, 2025 Discoverer Discoverer: Kelly Patterson of Cisco Talos

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-48894: Socomec DIRIS Digiware M-70 Cleartext Transmission Vulnerability