CVE-2026-10825: Improper JSON Input Validation in WebSocket API Leads to Denial of Service

Severity: high (CVSS 7.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-16 · updated 2026-10-26
Weakness: CWE-1287

Description

A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reboot.

Affected products

Moxa NPort 6000-G2 Series: from 1.0 through 1.1.0

References

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-268270-cve-2026-10825-improper-validation-of-input-vulnerability-in-serial-device-servers

Get alerted when CVE-2026-10825 or the next vulnerability affects your stack