Loading story…
Cisco Talos disclosed six denial-of-service vulnerabilities (six CVEs) affecting the Socomec DIRIS M-70 industrial gateway used for power monitoring and energy management, with impact concentrated in environments such as critical infrastructure, data centers, and healthcare. The issues affect firmware 1.6.9 and can be triggered remotely without authentication, potentially disrupting Modbus-related processing and causing operational outages or instability in deployments where the gateway is a key communications component (RS485/Ethernet; protocols including Modbus RTU/TCP, BACnet IP, and SNMP).
The research describes a technique to overcome hardware debugging constraints caused by the device’s STM32 Code Read-out Protection (RDP) Level 1, which blocks traditional JTAG-based inspection. Talos obtained an unencrypted firmware update and used a “good enough” emulation strategy: emulating only the single Modbus-handling thread (rather than full-system emulation) with Unicorn Engine, then applying coverage-guided fuzzing with AFL and using Qiling to visualize coverage and analyze crash root causes. Socomec reportedly patched the vulnerabilities following coordinated disclosure via Cisco’s policy.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Detection content was made available in the form of Snort rules to help identify attempts to exploit the DIRIS M-70 vulnerabilities. This accompanied public reporting on the six Modbus-related DoS flaws.
The six vulnerabilities were disclosed under Cisco's coordinated disclosure process and assigned CVEs. Socomec released patches and advised customers to upgrade to firmware version 1.7 or later to remediate the issues.
The fuzzing campaign uncovered six denial-of-service flaws in Socomec DIRIS M-70 firmware version 1.6.9. The issues allow unauthenticated remote attackers to crash or render the device inoperable by sending crafted Modbus messages over the network.
While analyzing the Socomec DIRIS M-70 industrial gateway, a Cisco Talos researcher used an unencrypted firmware update and SRAM dumping to work around STM32 RDP Level 1 protections, then emulated only the Modbus-handling thread with Unicorn and AFL. The approach was later adapted to Qiling to improve debugging and code-coverage visualization during crash triage and root-cause analysis.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Siemens disclosed multiple vulnerabilities in **SICAM 8** industrial control system products affecting **CPCI85 Central Processing/Communication**, **RTUM85 RTU Base**, and the **SICORE Base system**, with vulnerable versions identified as releases prior to **V26.10** or **V26.10.0** depending on the product. The issues are tracked as **`CVE-2026-27663`** and **`CVE-2026-27664`**, and can allow denial-of-service conditions in operational technology environments. Siemens published advisory **`SSA-246443`**, while the Canadian Centre for Cyber Security and CISA both urged asset owners to review the vendor guidance and apply the recommended updates. According to CISA, **`CVE-2026-27663`** is a resource exhaustion flaw in remote operation mode that can block parameterization and may require a reset or reboot, while **`CVE-2026-27664`** is an out-of-bounds write triggered by specially crafted XML input that can crash the affected service. Siemens has released fixed versions and advised organizations to validate patches before deployment and harden network access with segmentation, firewalls, and VPNs; CISA further recommended minimizing internet exposure of control systems and isolating OT networks from business networks to reduce the risk of disruption.
Jun 29, 2026
CISA and Mitsubishi Electric disclosed multiple denial-of-service vulnerabilities affecting **MELSEC iQ-R** industrial controllers and related modules used in the critical manufacturing sector. The issues include improper input validation in `CVE-2022-40265`, improper session management in `CVE-2021-20591`, and uncontrolled resource consumption flaws tracked as `CVE-2020-5666` and `CVE-2020-5527`. The vulnerabilities can be exploited remotely in various configurations to disrupt communications, block legitimate client connections, or force affected devices into an unresponsive state that may require a system reset or port recovery. Affected products span MELSEC iQ-R CPU modules, Ethernet interfaces, C Controller modules, and broader MELSEC controller families including **iQ-F, Q, L, and F series** in some cases. Mitsubishi Electric issued firmware updates and mitigations such as disabling unnecessary web server functions, upgrading to fixed firmware, restricting network access with firewalls and IP filtering, and limiting exposure to trusted LAN environments or VPN-protected remote access. CISA also urged operators to isolate control systems from business networks and reduce Internet exposure; at the time of the advisories, no known public exploits were reported as specifically targeting these flaws.
Jun 29, 2026
Public disclosures highlighted multiple high-severity vulnerabilities across industrial control systems, open-source software, and consumer networking gear, with several issues enabling **unauthenticated remote compromise**. Johnson Controls disclosed **CVE-2025-26385** (CVSS 10.0), a critical SQL injection affecting multiple building/ICS management products (including *ADS/ADX, LCS8500, NAE8500, SCT, CCT*) that can allow remote, unauthenticated attackers to execute arbitrary SQL to alter/delete/exfiltrate data; CISA guidance emphasized isolating control system networks from the internet, segmentation, and controlled remote access (e.g., VPNs). Additional unauthenticated remote issues include **CVE-2026-25069** in *SunFounder Pironman Dashboard* (path traversal in log API endpoints enabling arbitrary file read/deletion) and **CVE-2025-51958** in the *DokuWiki* `runcommand` plugin (unauthenticated command execution via `lib/plugins/runcommand/postaction.php`). Other disclosures include developer-tooling and application-layer injection flaws and multiple router memory-corruption bugs with public exploit references. *Orval* fixed **CVE-2026-25141**, a code-injection issue where incomplete escaping can be bypassed using **JSFuck**-style payloads, and *Cybersecurity AI (CAI)* addressed **CVE-2026-25130**, where `subprocess.Popen(..., shell=True)` enables argument/command injection leading to RCE (notably via the `find_file()` tool). Data-layer issues include **CVE-2025-69662** in *geopandas* (`to_postgis()` SQL injection) and **CVE-2026-24854** in *ChurchCRM* (authenticated SQL injection via `PerID` in `/PaddleNumEditor.php`, patched in 6.7.2), while **CVE-2025-36384** affects *IBM Db2 for Windows* (local privilege escalation via unquoted search path). SOHO router flaws **CVE-2026-1686** (*Totolink A3600R*) and **CVE-2026-1637** (*Tenda AC21*) describe remotely reachable buffer/stack overflows with publicly available exploit material, increasing the likelihood of opportunistic exploitation where exposed management interfaces exist.
Jun 29, 2026