8
CVEs
0
Critical
4
High
0
KEV
1
PoC
3
Unpatched C/H
12.5%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
4
MEDIUM
4
LOW
0
Monthly CVE Trend
Affected Products (30)
Awk 3131A Firmware
14
Eds 408A Firmware
13
Eds 405A Firmware
13
Iks G6824A Firmware
10
Mxview
10
Eds 510A Firmware
10
Tn 5900 Firmware
9
Edr G903 Firmware
9
Mxsecurity
9
Nport 5200 Series Firmware
8
Nport 5600 8 Dtl Series Firmware
8
Nport 5100 Series Firmware
8
Nport 5200A Series Firmware
8
Nport Iaw5000A I O Firmware
8
Nport 6100 Series Firmware
8
Nport 5X50A1 M12 Series Firmware
8
Nport 5100A Series Firmware
8
Nport 5400 Series Firmware
8
Nport P5150A Series Firmware
8
Nport 5600 Series Firmware
8
Eds G512E Firmware
7
Thingspro
7
Eds G516E Firmware
7
Pt 7828 R Hv Hv Firmware
6
Pt 7528 16Mst 8Tx 4Gsfp Wv Firmware
6
Pt 7528 16Mst 8Tx 4Gsfp Hv Hv Firmware
6
Pt 7528 8Msc 16Tx 4Gsfp Hv Hv Firmware
6
Pt 7528 20Msc 4Tx 4Gsfp Hv Hv Firmware
6
Pt 7828 R 24 Firmware
6
Pt 7528 20Mst 4Tx 4Gsfp Wv Firmware
6
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-10829 | Remote code execution in Moxa NPort W2150A-W4/W2250A-W4 Series firmware version 1.5 and earlier allows authenticated administrators to corrupt memory by submitting an overlong 'Server location' value on the Basic settings page of the web management interface, yielding root-level command execution on the embedded serial device server. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but Moxa has issued advisory MPSA-261910 confirming the flaw. The companion CVE-2026-10828 (format string) was disclosed in the same advisory, suggesting the web management stack received broader scrutiny. | HIGH | 8.6 | 0.4% | 43 |
No patch
|
| CVE-2026-10825 | Denial-of-service in Moxa NPort 6000-G2 Series serial device servers allows a low-privileged authenticated attacker to disrupt service and potentially trigger an unexpected device reboot via specially crafted JSON requests to the WebSocket API. The CVSS 4.0 base score of 7.1 reflects high availability impact with no confidentiality or integrity loss. Per current intelligence, there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. | HIGH | 7.1 | 0.3% | 36 |
No patch
|
| CVE-2026-4483 | Moxa MxGeneralIo utility versions prior to 1.4.0/1.5.0 expose IOCTL interfaces allowing authenticated high-privilege local attackers to directly access Model-Specific Registers (MSR) and system memory, enabling privilege escalation on Windows 7 or denial-of-service crashes (BSoD) on Windows 10/11. While CVSS 7.0 reflects high availability impact and network attack vector classification, the actual exploit requires local high-privilege access (PR:H), significantly reducing practical risk. No confirmed active exploitation (not in CISA KEV) or public proof-of-concept has been identified at time of analysis, though vendor advisory confirms patch availability. | HIGH | 7.0 | 0.0% | 35 |
|
| CVE-2026-9266 | Disk encryption bypass in Moxa UC-1200A series industrial computers allows an attacker with invasive physical access to recover the LUKS disk encryption key by sniffing the SPI bus between the CPU and TPM2 chip. The flaw is an incomplete fix for CVE-2026-0714 - Moxa added TPM2 parameter encryption but misconfigured the authorization session so the encryption provides no real protection. No public exploit identified at time of analysis, and the CVSS 4.0 vector (AV:P) reflects that exploitation is bounded to attackers who can physically open the device. | HIGH | 7.0 | 0.0% | 35 |
No patch
|
| CVE-2026-10828 | Format string exploitation in Moxa NPort W2150A-W4/W2250A-W4 and W2150A/W2250A series wireless serial device servers (firmware v1.5 and prior) allows network-accessible, authenticated administrators to leak arbitrary stack memory through the web management interface. The 'alias' parameter on the Serial Param configuration page passes attacker-controlled input directly to a printf-family function without sanitization, violating CWE-134. The disclosed memory contents can be used to defeat ASLR, making this vulnerability a likely prerequisite stepping-stone to CVE-2026-10829 (stack-based buffer overflow) documented in the same Moxa advisory MPSA-261910. No public exploit and no CISA KEV listing are identified at time of analysis. | MEDIUM | 6.9 | 0.3% | 34 |
No patch
|
| CVE-2026-10831 | Serial device servers in the Moxa NPort 6000 and CN2600 product lines expose a command port that accepts break signal commands without verifying the sender holds a valid associated data port session. Remote unauthenticated attackers with network access to the command port can disrupt active serial communication sessions, causing a denial of service for any device or system relying on that serial link. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog. | MEDIUM | 6.9 | 0.3% | 34 |
No patch
|
| CVE-2026-0715 | Bootloader menu access in Moxa UC series industrial computers can be obtained by attackers with physical access using a device-unique password, potentially enabling temporary denial-of-service through firmware reflashing. The vulnerability is constrained by bootloader signature verification that prevents installation of unsigned firmware or arbitrary code execution. No patch is currently available for affected Linux and UC firmware versions. | MEDIUM | 6.8 | 0.0% | 34 |
No patch
|
| CVE-2026-0714 | TPM-backed LUKS encryption bypass in Moxa Industrial Linux 3 on select industrial computers allows an attacker with invasive physical access to the SPI bus to intercept TPM communications and decrypt eMMC storage contents offline. This attack requires opening the device and connecting specialized equipment for extended signal capture, making it impractical for opportunistic access scenarios. Affected products include V1222 Ct T, Uc 3430a T Lte Wifi, Uc 8220 T Lx, and Uc 4414a I T firmware variants. | MEDIUM | 6.8 | 0.0% | 34 |
PoC
No patch
|