TI-2026-09298 Aliases CVE-2026-10831 GHSA-fxj4-v3m4-37hj

Improper Authorization of Break Signal Commands in Devices

LOW 30CWE-862Published 2026-06-16 · Updated 2026-06-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does not properly validate whether a sender is associated with a valid data port session before accepting break signal commands. A remote attacker with network access can send crafted requests to disrupt serial communication for an active user session.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00292 21st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Moxa	NPort 6000 Series	1.0 – 2.3	—	No fix listed	CNA
Moxa	CN2600 Series	1.0 – 4.6	—	No fix listed	CNA

NPort 6000 Series VendorMoxa Affected 1.0 – 2.3 Fixed in — No fix listed CNA
CN2600 Series VendorMoxa Affected 1.0 – 4.6 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-10831
2026-10-03 Alias added: GHSA-fxj4-v3m4-37hj

References

Advisory 1

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-262370-cve-2026-10831-improper-authorization-vulnerability-in-serial-device-servers

TI-2021-17455 Hard-coded credentials in Moxa MXView Series CVSS 3.1CRITICAL 9.8
TI-2010-04465 Stack-based buffer overflow in a certain ActiveX control in MediaDBPlayback.DLL 2.2.0.5… CVSS 2.0HIGH 10.0
TI-2022-19087 A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008… CVSS 3.1HIGH 7.5
TI-2016-07634 Missing brute-force protection in Moxa NPort CVSS 3.1CRITICAL 9.8
TI-2021-17457 Cleartext transmission of sensitive information in Moxa MXView Series CVSS 3.1HIGH 7.5
TI-2022-19326 Information disclosure in Moxa SDS-3008 Series Industrial Ethernet Switch CVSS 3.1MEDIUM 5.3

See all 328 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences