A recent vulnerability research effort has unveiled critical Denial-of-Service (DoS) flaws in the Socomec DIRIS M-70 IIoT device, a critical component used in industrial energy management.
A Cisco Talos researcher bypassed traditional debugging techniques and employed a streamlined emulation strategy to discover these vulnerabilities.
By focusing on the Modbus protocol, a key feature of the device’s operations, the researcher identified six CVEs related to DoS vulnerabilities, which the manufacturer swiftly patched.
Emulating For Vulnerability Discovery
The Socomec DIRIS M-70 gateway is integral to industrial IoT (IIoT) environments, handling data communication via protocols such as Modbus RTU, Modbus TCP, BACnet IP, and SNMP.
This broad communication support made the device an attractive research target, especially considering its critical role in sectors such as energy, healthcare, and data centers.
The research focused on exploiting potential vulnerabilities in the device’s Modbus protocol handling code running on a real-time operating system (RTOS), µC/OS-III.
The primary obstacle to debugging the Socomec device was Code Read-out Protection (RDP) Level 1, which restricts access to the device’s flash memory when JTAG or other debugging tools are attached.
This protection prevents the direct dumping of the device’s code, effectively halting traditional analysis methods.
However, two key opportunities arose during the investigation: the availability of an unencrypted firmware update file and the ability to access SRAM during the device’s execution, even with RDP enabled.
Given the constraints, the researcher pivoted to emulation as a solution. Using the Unicorn Engine a powerful CPU emulation framework the researcher chose to emulate only the Modbus handling thread, thereby bypassing the complexity of full-system emulation.
This targeted emulation enabled a “good enough” inspection of the Modbus code, allowing flaws to be detected without the need for exhaustive system-level emulation.
Fuzzing and Root Cause Analysis
To identify vulnerabilities within the Modbus protocol, the researcher used fuzzing techniques, specifically coverage-guided fuzzing integrated with the Unicorn Engine through the American Fuzzy Lop (AFL) tool.
The AFL integration helped automate testing, enabling the exploration of multiple execution paths, which is crucial in a system supporting over 700 unique Modbus message types.
While fuzzing triggered multiple crashes, identifying the root cause proved challenging without the ability to debug the system directly.
However, the researcher turned to the udbserver tool, which enabled debugging of the emulated Unicorn code using GDB. This approach enabled effective triage of crashes, leading to the discovery of several critical vulnerabilities in the Modbus protocol-handling code.
Additionally, the researcher leveraged the Qiling framework, a full system emulator based on Unicorn, to visualize code coverage during fuzzing.
This helped quickly identify unexplored paths and provided further insight into the crash causes. Combining the Qiling framework’s code coverage features with AFL fuzzing identified multiple DoS vulnerabilities in Modbus handling, which were reported as CVEs.
The research led to the discovery of six CVEs, all linked to DoS vulnerabilities that could disrupt the operation of the Socomec DIRIS M-70 IIoT device.
These vulnerabilities, if exploited, could compromise critical infrastructure and lead to operational outages. The vulnerabilities were responsibly disclosed to the manufacturer under Cisco’s Coordinated Disclosure Policy and have since been patched.
According to Talos Intelligence, this research underscores the importance of using innovative emulation techniques, such as selective thread emulation and fuzzing, for uncovering vulnerabilities in complex industrial devices.
By demonstrating that “good enough” emulation can lead to impactful findings, the researcher highlights an effective approach to tackling IoT security flaws, ultimately making IIoT environments safer from attack.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 flaws in the Socomec DIRIS M-70 IIoT device, a critical){kind=link}