EUVD-2026-37119
GHSA-fxj4-v3m4-37hj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no auth required (PR:N); scope changed because serial-attached downstream systems are impacted; no confidentiality loss, limited integrity and availability disruption.
Primary rating from Vendor (Moxa).
CVSS VectorVendor: Moxa
Lifecycle Timeline
1DescriptionCVE.org
A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does not properly validate whether a sender is associated with a valid data port session before accepting break signal commands. A remote attacker with network access can send crafted requests to disrupt serial communication for an active user session.
AnalysisAI
Serial device servers in the Moxa NPort 6000 and CN2600 product lines expose a command port that accepts break signal commands without verifying the sender holds a valid associated data port session. Remote unauthenticated attackers with network access to the command port can disrupt active serial communication sessions, causing a denial of service for any device or system relying on that serial link. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Technical ContextAI
Moxa NPort and CN2600 devices are serial-to-network device servers commonly deployed in industrial, OT, and embedded environments to expose RS-232/422/485 serial ports over TCP/IP. The devices expose both a data port (for serial traffic) and a command port (for control signals such as break, RTS/CTS). CWE-862 (Missing Authorization) describes the root cause: the command port does not implement a check that confirms an inbound break signal command originates from a sender associated with an established data port session. This design omission allows any network-reachable host to send control-plane commands to active serial sessions. Affected CPEs are cpe:2.3:a:moxa:nport_6000_series:*:*:*:*:*:*:*:* and cpe:2.3:a:moxa:cn2600_series:*:*:*:*:*:*:*:*, with the wildcard version field indicating all versions may be affected.
RemediationAI
Consult the Moxa advisory at https://www.moxa.com/en/support/product-support/security-advisory/mpsa-262370-cve-2026-10831-improper-authorization-vulnerability-in-serial-device-servers for firmware updates and exact patched version numbers, which are not specified in the currently available data. As an interim compensating control, restrict network access to the NPort command port using firewall rules or network ACLs so that only legitimate host addresses associated with authorized data port clients can reach the command interface - this directly counteracts the missing session-association check. Additionally, segment NPort devices into isolated OT network zones with strict ingress filtering to prevent arbitrary internet or corporate LAN hosts from reaching the command port. Note that port-level firewall rules address the exposure but do not fix the underlying CWE-862 authorization defect; firmware patching remains the definitive remediation.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today