CVE-2026-0715

HIGH EPSS 12.7%
Published Feb 5, 20264mo ago · Modified Jun 17, 20261w ago
7.0 CVSS 4.0
High
Find Similar
Published Feb 5, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago

Description

Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An attacker with physical access to the device could use this information to access the bootloader menu via a serial interface.  Access to the bootloader menu does not allow full system takeover or privilege escalation. The bootloader enforces digital signature verification and only permits flashing of Moxa-signed images. As a result, an attacker cannot install malicious firmware or execute arbitrary code. The primary impact is limited to a potential temporary denial-of-service condition if a valid image is reflashed. Remote exploitation is not possible.

CVSS Details

Base Score
7.0
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Physical
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
12.7% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-522

Affected Products 70

VendorProductVersionRange
moxauc-1222a_firmware* ≤1.4
moxauc-1222a*any
moxauc-2222a-t-us_firmware* ≤1.4
moxauc-2222a-t-us*any
moxauc-2222a-t_firmware* ≤1.4
moxauc-2222a-t*any
moxauc-2222a-t-ap_firmware* ≤1.4
moxauc-2222a-t-ap*any
moxauc-2222a-t-eu_firmware* ≤1.4
moxauc-2222a-t-eu*any
moxauc-3434a-t-lte-wifi_firmware* ≤1.2
moxauc-3434a-t-lte-wifi*any
moxauc-3424a-t-lte_firmware* ≤1.2
moxauc-3424a-t-lte*any
moxauc-3420a-t-lte_firmware* ≤1.2
moxauc-3420a-t-lte*any
moxauc-3430a-t-lte-wifi_firmware* ≤1.2
moxauc-3430a-t-lte-wifi*any
moxauc-4450a-t-5g_firmware* ≤1.3
moxauc-4450a-t-5g*any
moxauc-4434a-i-t_firmware* ≤1.3
moxauc-4434a-i-t*any
moxauc-4410a-t_firmware* ≤1.3
moxauc-4410a-t*any
moxauc-4454a-t-5g_firmware* ≤1.3
moxauc-4454a-t-5g*any
moxauc-4414a-i-t_firmware* ≤1.3
moxauc-4414a-i-t*any
moxauc-4430a-t_firmware* ≤1.3
moxauc-4430a-t*any
moxauc-8210-t-lx-s_firmware* ≤1.5
moxauc-8210-t-lx-s*any
moxauc-8220-t-lx-eu-s_firmware* ≤1.5
moxauc-8220-t-lx-eu-s*any
moxauc-8220-t-lx-ap-s_firmware* ≤1.5
moxauc-8220-t-lx-ap-s*any
moxauc-8220-t-lx-us-s_firmware* ≤1.5
moxauc-8220-t-lx-us-s*any
moxauc-8220-t-lx_firmware* ≤1.5
moxauc-8220-t-lx*any
moxav1202-ct-t_firmware* ≤1.2.0
moxav1202-ct-t*any
moxav1222-ct-t_firmware* ≤1.2.0
moxav1222-ct-t*any
moxav1222-w-ct-t_firmware* ≤1.2.0
moxav1222-w-ct-t*any
moxav2406c-kl7-ct-t_firmware* ≤1.2
moxav2406c-kl7-ct-t*any
moxav2406c-kl7-t_firmware* ≤1.2
moxav2406c-kl7-t*any
moxav2406c-wl7-ct-t_firmware* ≤1.2
moxav2406c-wl7-ct-t*any
moxav2406c-wl5-t_firmware* ≤1.2
moxav2406c-wl5-t*any
moxav2406c-kl1-ct-t_firmware* ≤1.2
moxav2406c-kl1-ct-t*any
moxav2406c-wl3-t_firmware* ≤1.2
moxav2406c-wl3-t*any
moxav2406c-wl1-ct-t_firmware* ≤1.2
moxav2406c-wl1-ct-t*any
moxav2406c-kl3-t_firmware* ≤1.2
moxav2406c-kl3-t*any
moxav2406c-wl1-t_firmware* ≤1.2
moxav2406c-wl1-t*any
moxav2406c-kl1-t_firmware* ≤1.2
moxav2406c-kl1-t*any
moxav2406c-wl7-t_firmware* ≤1.2
moxav2406c-wl7-t*any
moxav2406c-kl5-t_firmware* ≤1.2
moxav2406c-kl5-t*any

References 1

  • moxa.com https://www.moxa.com/en/support/product-support/security-advisory/mpsa-255121-cve-2026-0714-cve-2026-0715-multiple-vulnerabilities-in-industrial-computers
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.