CVE-2026-10831

Vulnerability

The vulnerability exists in Moxa NPort serial device servers. The command interface does not properly verify that a sender is associated with a valid data port session before processing break signal commands. This missing authorization (CWE-862) allows an attacker to send crafted break signal requests. Affected product series include NPort devices; specific versions are documented in Moxa security advisory MPSA-262370 [1].

Exploitation

An attacker with network access to the command port can send specially crafted requests containing break signal commands. No authentication is required (CVSS 4.0 vector indicates PR:N). The attacker does not need prior knowledge of active sessions. By sending the malicious break signal, the attacker disrupts ongoing serial communication for legitimate users.

Impact

Successful exploitation results in denial of service — the serial communication for an active user session is disrupted. This can cause temporary loss of serial device connectivity, affecting integrity (low) and availability (low) of the serial link. Confidentiality is not impacted per the CVSS vector [1].

Mitigation

Moxa has developed firmware updates for affected NPort product series. Users should apply the patches as provided in security advisory MPSA-262370 [1]. As the severity is medium, users may schedule the update during the next maintenance cycle. No workarounds are documented.