Is CVE-2026-10825 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10825 being exploited in the wild.

How severe is CVE-2026-10825?

Informational severity, with a CVSS score of 7.1, published 16 June 2026.

Which products and versions are affected?

Moxa NPort 6000-G2 Series v1.1.0 and earlier; Moxa NPort 6400-G2 Series v1.1.0 and earlier; Moxa NPort 6600-G2 Series v1.1.0 and earlier.

Is there a fix for CVE-2026-10825?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10825 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-10825?

Check whether you run Moxa NPort 6000-G2 Series, Moxa NPort 6100-G2 Series, Moxa NPort 6200-G2 Series or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10825: Moxa NPort 6000-G2 Series denial of service in WebSocket API

CVE-2026-10825 · Severity: info · CVSS 7.1 · Published 2026-06-16

A security vulnerability has been identified in Moxa NPort 6000-G2 series serial device servers, which are used to connect industrial serial devices to networks. An attacker with low-level access credentials can send a malicious request that crashes the device or causes it to reboot unexpectedly. This can lead to a loss of connectivity for critical industrial equipment and disrupt operations.

Vendors: Moxa.

Quick answers

Is CVE-2026-10825 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10825 being exploited in the wild.
How severe is CVE-2026-10825?: Informational severity, with a CVSS score of 7.1, published 16 June 2026.
Which products and versions are affected?: Moxa NPort 6000-G2 Series v1.1.0 and earlier; Moxa NPort 6400-G2 Series v1.1.0 and earlier; Moxa NPort 6600-G2 Series v1.1.0 and earlier.
Is there a fix for CVE-2026-10825?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10825 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-10825?: Check whether you run Moxa NPort 6000-G2 Series, Moxa NPort 6100-G2 Series, Moxa NPort 6200-G2 Series or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial-of-service (DoS) vulnerability exists in the WebSocket API of Moxa NPort 6000-G2 series serial device servers due to improper validation of input types (CWE-1287). The root cause is insufficient handling of JSON-based requests within the API component. A remote attacker with low-privileged authentication can exploit this by sending a specially crafted JSON request over the network. Successful exploitation results in service disruption or an unexpected hardware reboot. Moxa has released firmware version v1.2.0 to address this issue.

Affected products

Moxa NPort 6000-G2 Series v1.1.0 and earlier
Moxa NPort 6100-G2/6200-G2 Series v1.1.0 and earlier
Moxa NPort 6400-G2 Series v1.1.0 and earlier
Moxa NPort 6600-G2 Series v1.1.0 and earlier

Timeline

2026-06-16: advisory: Moxa published security advisory MPSA-268270
2026-06-16: disclosed: CVE-2026-10825 published to NVD dataset

References

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-268270-cve-2026-10825-improper-validation-of-input-vulnerability-in-serial-device-servers

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.