Socomec DIRIS A-40 power monitoring devices expose a web API on TCP port 80 that does not enforce authentication. Consequently, an attacker on the local network can send API requests and perform any operations the API allows without credentials. This constitutes an authentication bypass weakness identified as CWE-306.

The affected product is Socomec DIRIS A-40. No specific firmware or revision information is provided, so all installations of this device should be considered potentially vulnerable. (Known affected version data is missing.)

The vulnerability has a CVSS base score of 6.3, indicating moderate severity, and an EPSS score of less than 1%, suggesting a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack vector is local network (network‑adjacent) and requires only access to the device’s default HTTP service; no authentication or additional credentials are needed. These characteristics mean the flaw can be easily leveraged by any attacker who can reach the device over TCP port 80.