Which versions of Moxa NPort 6000-G2 are affected by CVE-2026-10825?

Moxa NPort 6000-G2 Series serial device servers contain a denial-of-service vulnerability affecting availability with no vendor-released patch identified at time of analysis.

How to fix or mitigate CVE-2026-10825?

Within 24 hours: Identify all Moxa NPort 6000-G2 devices in your infrastructure and classify by operational criticality; change default credentials immediately. Within 7 days: Implement firewall rules restricting WebSocket API access to authorized personnel only; enable connection logging and alerting on all WebSocket endpoints to these devices. Within 30 days: Establish vendor communication to track patch release timeline; prepare maintenance window and deployment procedures for patch deployment once available from Moxa.

Moxa NPort 6000-G2 CVE-2026-10825

Q: What is the CVSS score of CVE-2026-10825?

CVE-2026-10825 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-37043 HIGH

Improper Validation of Specified Type of Input (CWE-1287)

2026-06-16 Moxa

GHSA-9269-mhf5-vfqw

Information Disclosure Nport 6000 G2 Series

7.1

CVSS 4.0 · Vendor: Moxa

Severity by source

Vendor (Moxa) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable WebSocket API exploitable by any authenticated low-privileged user with no user interaction; pure DoS via reboot gives A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Moxa).

CVSS VectorVendor: Moxa

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 10:28 vuln.today

DescriptionCVE.org

A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reboot.

AnalysisAI

Denial-of-service in Moxa NPort 6000-G2 Series serial device servers allows a low-privileged authenticated attacker to disrupt service and potentially trigger an unexpected device reboot via specially crafted JSON requests to the WebSocket API. The CVSS 4.0 base score of 7.1 reflects high availability impact with no confidentiality or integrity loss. Per current intelligence, there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Moxa NPort 6000-G2 Series are industrial serial-to-Ethernet device servers commonly deployed to bridge legacy serial equipment (Modbus, RS-232/422/485) to TCP/IP networks in OT and ICS environments. The vulnerability resides in the management WebSocket API's JSON request handler, which performs insufficient validation of input - consistent with CWE-1287 (Improper Validation of Specified Type of Input). Malformed or unexpected JSON structures cause the WebSocket service to fail in a way that propagates into a device-wide fault, ultimately rebooting the appliance and severing serial-over-IP traffic until it returns to service.

RemediationAI

No vendor-released patch version is identified at time of analysis in the provided input; consult the Moxa PSIRT advisory MPSA-268270 at https://www.moxa.com/en/support/product-support/security-advisory/mpsa-268270-cve-2026-10825-improper-validation-of-input-vulnerability-in-serial-device-servers for the fixed firmware build for your specific NPort 6000-G2 model and apply it during a planned maintenance window since the device reboots on update. Until a patch is deployed, restrict network reachability of the device's web/WebSocket management interface to a dedicated management VLAN or jump host (trade-off: legitimate remote administration becomes more cumbersome), disable or block the WebSocket management endpoint at an upstream firewall if your operational model allows HTTP-only management (trade-off: loses real-time UI features that depend on WebSocket), and audit local accounts to remove unnecessary low-privileged users since PR:L is the exploitation prerequisite (trade-off: may impact field technicians who relied on shared low-privilege accounts).