Socomec vulnerabilities
We track 19 vulnerabilities in Socomec products across 8 products. 19 are rated high or critical, and none are known to be exploited. The most recent was published on December 1, 2025.
Latest Socomec vulnerabilities
- 7.5 High severity
DIRIS Digiware M-70: Missing Authentication for Critical Functionality
A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to a denial of service. An attacker can send an unauthenticated pack
- 7.5 High severity
DIRIS Digiware M-70: Missing Authentication for Critical Functionality
A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to a denial of service. An attacker can send an unauthenticated pack
- 7.5 High severity
DIRIS Digiware M-70: Missing Authentication for Critical Functionality
A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted series of network requests can lead to a denial of service. An attacker can send a sequence of unauthenti
- 7.5 High severity
DIRIS Digiware M-70: Missing Authentication for Critical Functionality
A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted series of network requests can lead to a denial of service. An attacker can send a sequence of unauthenti
- 7.5 High severity
DIRIS Digiware M-70: Missing Authentication for Critical Functionality
A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted series of network requests can lead to a denial of service. An attacker can send a sequence of unauthenti
- 7.5 High severity
DIRIS Digiware M-70: Missing Authentication for Critical Functionality
A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted series of network requests can lead to a denial of service. An attacker can send a sequence of unauthenti
- 7.5 High severity
A buffer overflow vulnerability exists in the Modbus TCP functionality of Socomec DIRIS…
A buffer overflow vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted set of network packets can lead to denial of service. An attacker can send a sequence of unauthenticated packets to trigger this vu
- 7.5 High severity
DIRIS Digiware M-70: Missing Authentication for Critical Functionality
A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to denial of service. An attacker can send an unauthenticated packet to trigger this vulnerabili
- 8.8 High severity
DIRIS Digiware M-70: Cross-Site Request Forgery
A cross-site request forgery (csrf) vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request can lead to unauthorized access. An attacker can stage a malicious webpage to trigger this vulnerabil
- 7.5 High severity
DIRIS Digiware M-70: Cleartext Transmission of Sensitive Information
A cleartext transmission vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnera
- 7.5 High severity
DIRIS Digiware M-70: Missing Authentication for Critical Functionality
A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to denial of service. An attacker can send an unauthenticated packet to trigger this vulnerability.
- 7.3 High severity
Easy Config System: Authentication Bypass by Assumed-Immutable Data
An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database record can lead to unauthorized access. An attacker can modify a local database to trigger this vulne
- 7.1 High severity
Net vision: Cross-Site Request Forgery
Cross-Site Request Forgery vulnerability in Socomec Net Vision, version 7.20. This vulnerability could allow an attacker to trick registered users into performing critical actions, such as adding and updating accounts, due to lack of proper sanitisation of the
- 7.5 High severity
MODULYS GP (MOD3GP-SY-120K): Plaintext Storage of a Password
The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application.
- 8.8 High severity
MODULYS GP (MOD3GP-SY-120K): Cross-Site Request Forgery
Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged i
- 7.5 High severity
MODULYS GP (MOD3GP-SY-120K): Insecure Storage of Sensitive Information
Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process.
- 9.8 Critical severity
MODULYS GP (MOD3GP-SY-120K): Reliance on Cookies without Validation and Integrity Checking
Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device.
- 8.8 High severity
MODULYS GP (MOD3GP-SY-120K): Improper Control of Generation of Code
The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section (MAIL SERVER) where the information i
- 7.5 High severity
MODULYS GP: Weak Encoding for Password
SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threat actors obtaining sensitive information.