The vulnerability exists because Moxa Arm‑based industrial computers use a device‑unique bootloader password that is printed on the device. An attacker with physical access could connect to the serial interface and enter this password to reach the bootloader menu. The menu only allows the installation of firmware that passes digital signature verification, so the attacker cannot install malicious firmware or obtain elevated privileges. Nevertheless, using the menu to reflash a valid image can cause a temporary denial‑of‑service if the image is not properly aligned with operational requirements. Remote exploitation is not possible.

The vulnerability affects the Moxa UC‑1200A series of industrial computers that run Moxa Industrial Linux Secure. The advisory lists a broad set of other Moxa UC products, but the specific impact is tied to the UC‑1200A series where the device‑unique bootloader password is used.

The CVSS score is 7, reflecting a moderate severity. EPSS is less than 1%, indicating a very low likelihood of exploitation in the wild. The vulnerability is not present in CISA’s KEV catalog. Exploitation requires physical access to the device and connection to its serial console, making it much harder to achieve than a remote attack. The primary risk is a short‑lived denial of service if an attacker reboots or restores firmware with a valid image, but it cannot be used to compromise firmware integrity or execute arbitrary code.