CVE-2026-10831: NPort Device DoS Vulnerability

CVE-2026-10831 Overview

CVE-2026-10831 is a denial-of-service vulnerability affecting Moxa NPort serial device servers. The flaw stems from improper access control [CWE-862] on the command port of affected devices. The command interface fails to verify whether a sender is associated with a valid data port session before accepting break signal commands. A remote attacker with network access can send crafted requests that disrupt serial communication for an active user session. The issue impacts the availability of serial communication channels used in industrial and operational technology (OT) environments, where NPort devices commonly bridge serial equipment to TCP/IP networks.

Critical Impact
Unauthenticated remote attackers can interrupt active serial sessions on NPort devices, disrupting communication with connected industrial equipment.

Affected Products

Moxa NPort serial device servers (see Moxa Security Advisory MPSA-262370 for the full list of impacted models and firmware versions)

Discovery Timeline

2026-06-16 - CVE-2026-10831 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-10831

Vulnerability Analysis

NPort devices expose two logical channels: a data port that carries serial traffic between the network and the attached serial device, and a command port that accepts control messages such as break signals and configuration commands. The vulnerability arises because the command port does not bind incoming command requests to an authenticated or session-associated data port connection. As a result, any host that can reach the command port over the network can issue control commands, including break signal commands, that affect serial sessions established by legitimate users.

The EPSS score of 0.292% places the likelihood of near-term exploitation in the lower range, but the attack requires no privileges, no user interaction, and only network reachability to the device. In converged IT/OT networks, this exposure is meaningful because NPort devices often front critical serial-attached equipment.

Root Cause

The root cause is missing authorization [CWE-862] in the command port handler. The handler accepts break signal commands without validating that the requester owns or is bound to an active data port session. The trust boundary between command and data channels is not enforced.

Attack Vector

The attack vector is network-based. An attacker sends a crafted command request to the NPort command port. Because the command interface does not check session association, the device honors the break signal command and disrupts the active serial session of another user. No authentication or interaction with the target is required. Refer to the Moxa Security Advisory MPSA-262370 for protocol-level technical details.

Detection Methods for CVE-2026-10831

Indicators of Compromise

Unexpected break signal events or session interruptions reported by serial-attached equipment or supervisory systems.
Connections to the NPort command port originating from hosts that are not authorized administrative workstations.
Repeated, short-lived TCP connections to NPort command ports correlated with serial session resets.

Detection Strategies

Monitor NPort device logs and syslog forwards for break signal commands and abnormal command port activity.
Use network flow analysis to identify external or unexpected sources contacting NPort management and command ports.
Correlate operational disruptions on serial-attached equipment with command port traffic timelines.

Monitoring Recommendations

Forward NPort syslog to a centralized logging or SIEM platform and create alerts on command port access from non-allowlisted sources.
Track baseline patterns of serial session uptime and alert on anomalous session terminations.
Continuously review firewall and ACL hit counts on segments containing NPort devices to identify reconnaissance.

How to Mitigate CVE-2026-10831

Immediate Actions Required

Apply the firmware update referenced in the Moxa Security Advisory MPSA-262370 as soon as it is available for your model.
Restrict network reachability of NPort command ports to known administrative hosts using firewalls or ACLs.
Place NPort devices in segmented OT network zones, isolated from general corporate and internet-facing networks.

Patch Information

Moxa has published advisory MPSA-262370 covering this issue. Consult the advisory for the list of affected models, fixed firmware versions, and upgrade instructions. Validate firmware images against vendor-published hashes before deployment.

Workarounds

Block inbound traffic to the NPort command port from any host that does not require administrative access.
Enforce network segmentation between OT assets and general IT networks, following IEC 62443 zone and conduit guidance.
Disable or restrict remote command port functionality where the operational use case does not require it.

bash

# Example: restrict access to NPort command port using iptables on an upstream gateway
# Replace <NPORT_IP> with the device address and <ADMIN_SUBNET> with the authorized management range
iptables -A FORWARD -p tcp -s <ADMIN_SUBNET> -d <NPORT_IP> --dport 966 -j ACCEPT
iptables -A FORWARD -p tcp -d <NPORT_IP> --dport 966 -j DROP