Socomec
25 CVEs across 17 Socomec products. Browse Socomec vulnerabilities, severities, and proof-of-concept exploits.
Socomec products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2491 | Medium | 6.3 | 2026-03-16 | Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected inst… |
CVE-2025-55222 | High | 8.6 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially… |
CVE-2025-55221 | High | 8.6 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially… |
CVE-2025-54851 | High | 7.5 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted seri… |
CVE-2025-54850 | High | 7.5 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted seri… |
CVE-2025-54849 | High | 7.5 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted seri… |
CVE-2025-54848 | High | 7.5 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted seri… |
CVE-2025-26858 | High | 8.6 | 2025-12-01 | A buffer overflow vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted set of network packets can lea… |
CVE-2025-23417 | High | 8.6 | 2025-12-01 | A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can… |
CVE-2025-20085 | High | 7.2 | 2025-12-01 | A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can… |
CVE-2024-53684 | High | 7.5 | 2025-12-01 | A cross-site request forgery (csrf) vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request… |
CVE-2024-49572 | High | 7.2 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to d… |
CVE-2024-48894 | Medium | 5.9 | 2025-12-01 | A cleartext transmission vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request can lead to… |
CVE-2024-48882 | High | 8.6 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to d… |
CVE-2024-45370 | High | 7.3 | 2025-12-01 | An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database… |
CVE-2024-4601 | Medium | 6.7 | 2024-05-07 | An incorrect authentication vulnerability has been found in Socomec Net Vision affecting version 7.20. This vulnerability allows an attacker to perform a brute… |
CVE-2024-4600 | High | 7.1 | 2024-05-07 | Cross-Site Request Forgery vulnerability in Socomec Net Vision, version 7.20. This vulnerability could allow an attacker to trick registered users into perform… |
CVE-2023-39452 | High | 7.5 | 2023-09-18 | The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be do… |
CVE-2023-39446 | High | 8.9 | 2023-09-18 | Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is ne… |
CVE-2023-38582 | Medium | 6.3 | 2023-09-18 | Persistent cross-site scripting (XSS) in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScri… |
CVE-2023-38255 | Medium | 6.5 | 2023-09-18 | A potential attacker with or without (cookie theft) access to the device would be able to include malicious code (XSS) when uploading new devi… |
CVE-2023-41965 | High | 7.5 | 2023-09-18 | Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication proce… |
CVE-2023-41084 | Critical | 10.0 | 2023-09-18 | Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the… |
CVE-2023-40221 | High | 8.8 | 2023-09-18 | The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious c… |
CVE-2023-0356 | Medium | 5.7 | 2023-01-26 | SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threat actors obtaining… |
CVE-2021-41871 | Medium | 5.4 | 2021-12-15 | An issue was discovered in Socomec REMOTE VIEW PRO 2.0.41.4. Improper validation of input into the username field makes it possible to place a stored XSS paylo… |
CVE-2021-41870 | High | 8.8 | 2021-12-15 | An issue was discovered in the firmware update form in Socomec REMOTE VIEW PRO 2.0.41.4. An authenticated attacker can bypass a client-side file-type check and… |
CVE-2019-15859 | Critical | 9.8 | 2019-10-09 | Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a device via the /passwor… |