Loading story…
Moxa has disclosed multiple vulnerabilities in its NPort serial device server lines, including CVE-2026-10825, CVE-2026-10828, and CVE-2026-10829, affecting the NPort 6000-G2 Series, NPort W2150A-W4/W2250A-W4 Series, and older NPort W2150A/W2250A Series devices. The most severe issue, CVE-2026-10829, is a stack-based buffer overflow in the web interface's "Server location" parameter that can lead to memory corruption and potentially remote code execution with root privileges. Moxa also reported CVE-2026-10828, a format string flaw in the "alias" parameter that may expose sensitive memory and help bypass ASLR, and CVE-2026-10825, an improper JSON input validation flaw in the WebSocket API that can be exploited by a low-privileged authenticated attacker to cause denial of service and unexpected device reboots.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-17, the Canadian Centre for Cyber Security published advisory AV26-610 covering Moxa vulnerabilities CVE-2026-10825, CVE-2026-10828, and CVE-2026-10829 in several NPort serial device server lines. The Cyber Centre urged users and administrators to review Moxa's advisories and apply the necessary updates.
On 2026-06-17, CERT-FR published notice CERTFR-2026-AVI-0763 about a vulnerability in Moxa products. It said the flaw could let a remote attacker cause a denial-of-service condition and bypass security policy protections.
On 2026-06-16, CERT-FR published notice CERTFR-2026-AVI-0760 about multiple vulnerabilities in Moxa products. The notice said the flaws could allow arbitrary code execution, compromise confidentiality, and bypass security policy controls.
On 2026-06-16, Moxa published advisory MPSA-261910 covering CVE-2026-10828 and CVE-2026-10829 in NPort W2150A-W4/W2250A-W4 devices, with older W2150A/W2250A units also affected. The issues include a format string flaw and a stack-based buffer overflow that could enable memory disclosure, memory corruption, and potentially remote code execution with root privileges; Moxa provided firmware v1.5.1 for the W4 series and said phased-out older models should be replaced.
On 2026-06-16, Moxa published security advisory MPSA-268270 for CVE-2026-10825, an improper JSON input validation flaw in the WebSocket API affecting NPort 6000-G2 Series version 1.1.0 and earlier. Moxa said the issue could be exploited by a low-privileged authenticated attacker to cause denial of service or an unexpected reboot and advised updating to firmware v1.2.0 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcecert.ssi.gouv.fr
Open sourcecert.ssi.gouv.fr
Open sourcecvefeed.io
Open sourcemoxa.com
Open sourcemoxa.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT-FR published two advisories covering vulnerabilities in **Moxa** products, warning that the flaws could let attackers **escalate privileges** and undermine core security controls. One notice said successful exploitation could also affect **data confidentiality** and **data integrity**, raising concern for industrial and networked environments where Moxa equipment is commonly deployed. A separate CERT-FR notice reported another Moxa vulnerability that could allow an attacker to **bypass the security policy**. The advisories did not provide further technical details in the referenced content, including affected models, `CVE` identifiers, or specific remediation steps, leaving organizations to monitor vendor and national CERT guidance closely for product impact and patch information.
Jun 29, 2026
Moxa issued security advisories for multiple industrial and embedded product families, including the **UC Series**, **V Series**, **VM-1220 Series**, **ioThinx 4530 Series**, **AIG Series**, **BXP Series**, **DRP-A100/DRP-C100 Series**, and **RKP Series**. A Canadian Centre for Cyber Security notice highlighted the disclosures and directed operators to review Moxa’s published advisories and apply vendor-provided updates. The advisories include **`CVE-2026-46333`**, identified as the **"ssh-keysign-pwn"** vulnerability in the Linux kernel. The issue affects control-system environments using impacted Moxa platforms, raising patching and asset-review priorities for organizations that rely on these devices in operational technology and embedded deployments.
Jul 24, 2026
Moxa disclosed and patched **CVE-2024-12297**, a critical authorization flaw in multiple industrial Ethernet switch lines that can let a remote, unauthenticated attacker bypass authentication and access device functions. The vulnerability stems from weaknesses in frontend authorization logic and client-side versus back-end verification, allowing brute-force credential guessing and potential **MD5 collision** attacks to forge authentication hashes. Moxa rated the issue **CVSS 9.2** and said exploitation could expose sensitive configurations or disrupt services on affected switches. The flaw initially affected the **EDS-508A Series** on firmware `3.11` and earlier, and advisories later expanded coverage to additional **EDS**, **SDS**, and **PT series** models, including PT-508, PT-510, PT-7528, PT-7728, PT-7828, PT-G503, PT-G510, PT-G7728, and PT-G7828 below specified fixed versions. Moxa issued firmware updates for most impacted products and told some EDS-508A customers to obtain patches through technical support. The company also urged operators to minimize Internet exposure, restrict SSH and management access to trusted networks, apply least privilege and MFA where possible, and strengthen logging, IDS/IPS, and network monitoring around affected operational technology environments.
Jul 24, 2026