What is the CVSS score of CVE-2026-0715?

CVE-2026-0715 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of V1202 Ct T Firmware are affected by CVE-2026-0715?

CVE-2026-0715 presents notable security risk rated CVSS 6.8. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-0715?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

V1202 Ct T Firmware CVE-2026-0715

MEDIUM

Insufficiently Protected Credentials (CWE-522)

2026-02-05 psirt@moxa.com

Linux Privilege Escalation V1202 Ct T Firmware Uc 3424a T Lte Firmware V2406c Wl1 Ct T Firmware Uc 4450a T 5g Firmware Uc 4414a I T Firmware V2406c Wl7 Ct T Firmware Uc 8220 T Lx Eu S Firmware Uc 1222a Firmware V2406c Wl7 T Firmware Uc 8220 T Lx Ap S Firmware V2406c Wl3 T Firmware V2406c Kl3 T Firmware Uc 2222a T Eu Firmware V2406c Kl7 Ct T Firmware V1222 Ct T Firmware V2406c Kl1 Ct T Firmware Uc 2222a T Firmware V2406c Wl1 T Firmware Uc 3420a T Lte Firmware Uc 3434a T Lte Wifi Firmware Uc 4410a T Firmware V2406c Kl7 T Firmware V1222 W Ct T Firmware V2406c Wl5 T Firmware Uc 8210 T Lx S Firmware Uc 8220 T Lx Firmware V2406c Kl1 T Firmware Uc 2222a T Us Firmware Uc 4430a T Firmware Uc 4454a T 5g Firmware Uc 8220 T Lx Us S Firmware Uc 2222a T Ap Firmware Uc 4434a I T Firmware V2406c Kl5 T Firmware Uc 3430a T Lte Wifi Firmware

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 05, 2026 - 17:16 nvd

MEDIUM 6.8

DescriptionCVE.org

Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An attacker with physical access to the device could use this information to access the bootloader menu via a serial interface. Access to the bootloader menu does not allow full system takeover or privilege escalation. The bootloader enforces digital signature verification and only permits flashing of Moxa-signed images. As a result, an attacker cannot install malicious firmware or execute arbitrary code. The primary impact is limited to a potential temporary denial-of-service condition if a valid image is reflashed. Remote exploitation is not possible.

AnalysisAI

Bootloader menu access in Moxa UC series industrial computers can be obtained by attackers with physical access using a device-unique password, potentially enabling temporary denial-of-service through firmware reflashing. The vulnerability is constrained by bootloader signature verification that prevents installation of unsigned firmware or arbitrary code execution. No patch is currently available for affected Linux and UC firmware versions.

Technical ContextAI

Classified as CWE-522 (Insufficiently Protected Credentials). Affects the a serial component of Uc-1222A Firmware. Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An attacker with physical access to the device could use this information to access the bootloader menu via a serial interface. Access to the bootloader menu does not allow full system takeover or privilege escalation. The bootloader enforces digital signature verification and only permits flashing of Moxa-signed images. As a result, an attacker cannot install