TI-2025-13700 Aliases CVE-2025-15017 GHSA-r3r9-v3q6-hv5j

A vulnerability exists in serial device servers where active debug code remains enabled…

LOW 33CWE-489Published 2025-12-31 · Updated 2025-12-31

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical access to the device can directly connect to the UART interface and, without authentication, user interaction, or execution conditions, gain unauthorized access to internal debug functionality. Exploitation is low complexity and allows an attacker to execute privileged operations and access sensitive system resources, resulting in a high impact to the confidentiality, integrity, and availability of the affected device. No security impact to external or dependent systems has been identified.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0028 20th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Moxa	NPort 5000AI-M12 Series	1.0 and later	—	No fix listed	CNA
Moxa	NPort 5100 Series	1.0 and later	—	No fix listed	CNA
Moxa	NPort 5100A Series	1.0 and later	—	No fix listed	CNA
Moxa	NPort 5200 Series	1.0 and later	—	No fix listed	CNA
Moxa	NPort 5200A Series	1.0 and later	—	No fix listed	CNA
Moxa	NPort 5400 Series	1.0 and later	—	No fix listed	CNA
Moxa	NPort 5600 Series	1.0 and later	—	No fix listed	CNA
Moxa	NPort 5600-DT Series	1.0 and later	—	No fix listed	CNA
Moxa	NPort IA5000 Series	1.0 and later	—	No fix listed	CNA
Moxa	NPort IA5000A Series	1.0 and later	—	No fix listed	CNA
Moxa	NPort IA5000-G2 Series	1.0 and later	—	No fix listed	CNA

NPort 5000AI-M12 Series VendorMoxa Affected 1.0 and later Fixed in — No fix listed CNA
NPort 5100 Series VendorMoxa Affected 1.0 and later Fixed in — No fix listed CNA
NPort 5100A Series VendorMoxa Affected 1.0 and later Fixed in — No fix listed CNA
NPort 5200 Series VendorMoxa Affected 1.0 and later Fixed in — No fix listed CNA
NPort 5200A Series VendorMoxa Affected 1.0 and later Fixed in — No fix listed CNA
NPort 5400 Series VendorMoxa Affected 1.0 and later Fixed in — No fix listed CNA
NPort 5600 Series VendorMoxa Affected 1.0 and later Fixed in — No fix listed CNA
NPort 5600-DT Series VendorMoxa Affected 1.0 and later Fixed in — No fix listed CNA
NPort IA5000 Series VendorMoxa Affected 1.0 and later Fixed in — No fix listed CNA
NPort IA5000A Series VendorMoxa Affected 1.0 and later Fixed in — No fix listed CNA
NPort IA5000-G2 Series VendorMoxa Affected 1.0 and later Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-15017
2026-10-03 Alias added: GHSA-r3r9-v3q6-hv5j

References

Advisory 1

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-257331-cve-2025-15017-active-debug-code-vulnerability-in-serial-device-servers

TI-2021-17455 Hard-coded credentials in Moxa MXView Series CVSS 3.1CRITICAL 9.8
TI-2010-04465 Stack-based buffer overflow in a certain ActiveX control in MediaDBPlayback.DLL 2.2.0.5… CVSS 2.0HIGH 10.0
TI-2022-19087 A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008… CVSS 3.1HIGH 7.5
TI-2016-07634 Missing brute-force protection in Moxa NPort CVSS 3.1CRITICAL 9.8
TI-2021-17457 Cleartext transmission of sensitive information in Moxa MXView Series CVSS 3.1HIGH 7.5
TI-2022-19326 Information disclosure in Moxa SDS-3008 Series Industrial Ethernet Switch CVSS 3.1MEDIUM 5.3

See all 328 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences