CVE-2026-10825

Improper JSON Input Validation in WebSocket API Leads to Denial of Service

Published Jun 16, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reboot.

Analysis

Technical impact

A vulnerability in the WebSocket API of Moxa NPort 6000‑G2 serial device servers allows a low‑privileged authenticated attacker to send a specially crafted JSON request that is insufficiently validated. The result is a denial of service that may cause an unexpected device reboot, disrupting availability of the device and any systems that depend on it.

Affected Systems

Moxa NPort 6000‑G2 Series devices, firmware versions 1.2.0 and earlier, which expose the vulnerable WebSocket endpoint.

Risk and Exploitability

The CVSS score of 7.1 indicates a high‑severity denial‑of‑service risk. The EPSS score, which is less than 1 %, shows that exploitation has been observed rarely, and the vulnerability is not listed in CISA’s KEV catalog. Attackers need only legitimate but low‑privilege credentials and can target the WebSocket interface remotely. When the malformed JSON request reaches the device, the server fails to handle it gracefully, leading to an interruption of service and a possible reboot.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Moxa

NPort 6000-G2 Series

unaffected

Version	Status	Constraints
`1.0`	affected	≤ 1.1.0
`1.2.0`	unaffected	—

No data.

Vendor Product Versions

Moxa

Nport 6000-g2 Series

Version	Status	Scheme	Platform
`[1.0,1.1.0]`	affected	generic	—
`1.2.0`	unaffected	semver	—

Remediation

Vendor Solution

Please refer to the security advisory: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-268270-cve-2026-10825-improper-validation-of-input-vulnerability-in-serial-device-servers

OpenCVE Recommended Actions

Update the device firmware to the version supplied in Moxa’s security advisory.
If the WebSocket functionality is not required, disable the API to reduce the attack surface.
Configure firewall or access control lists to restrict network access to the WebSocket port to trusted hosts only.

Generated by OpenCVE AI on June 17, 2026 at 22:45 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.240% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-268270-cve-2026-10825-improper-validation-of-input-vulnerability-in-serial-device-servers

History

Jun 16, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 16, 2026 9:45 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reboot.
Title		Improper JSON Input Validation in WebSocket API Leads to Denial of Service
First Time appeared		Moxa Moxa nport 6000-g2 Series
Weaknesses		CWE-1287
CPEs		cpe:2.3:a:moxa:nport_6000-g2_series:::::::: cpe:2.3:a:moxa:nport_6000-g2_series:1.2.0:::::::*
Vendors & Products		Moxa Moxa nport 6000-g2 Series
References		https://www.moxa.com/en/support/product-support/security-advisory/mpsa-268270-cve-2026-10825-improper-validation-of-input-vulnerability-in-serial-device-servers
Metrics		cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`