CVE-2026-10825

Executive Summary

CVE-2026-10825 is a high-severity denial-of-service (DoS) vulnerability in Moxa serial device servers' WebSocket API, stemming from improper JSON input validation (CWE-20). A low-privileged authenticated attacker can exploit this flaw over the network, sending specially crafted JSON requests that exhaust service resources or trigger an unexpected device reboot, impacting the operational availability of ICS/SCADA infrastructure. The vulnerability affects an unspecified range of Moxa serial device server products; while no CISA KEV listing or active weaponized exploit has been identified, public PoC interest and the low EPSS score (0.0024) suggest limited in-the-wild exploitation to date.

Technical Analysis

The vulnerability resides in the WebSocket API endpoint exposed by Moxa serial device servers, typically listening on port 443 (WSS) or port 80/8080 (WS) for device management and data relay functions. The WebSocket service parses JSON-formatted requests for control operations—such as serial port configuration changes, firmware updates, or status queries—without adequate schema validation and depth/size limitations.

Mechanism:

1. Unvalidated Input Entry Point: The WebSocket handler deserializes incoming JSON payloads using a recursive parser. The parser does not enforce constraints on:

   • Nested object depth (exploitable via deep recursion, e.g., 10,000 nested {"a": layers).
   • Total payload size (no limit, allowing multi-megabyte payloads to exhaust heap memory).
   • Duplicate keys (parser may enter infinite loops on malicious key traversal).
   • Type confusion (e.g., sending an array where an object is expected, causing a null-pointer dereference).

2. Resource Exhaustion: Specially crafted JSON can cause exponential memory allocation during recursive parsing. When the device's embedded OS (typically VxWorks or embedded Linux) exhausts its limited heap (often 32–128 MB), the process crashes. The watchdog timer subsequently triggers a full system reboot, resulting in a DoS condition.

3. Service Disruption: A successful attack either:

   • Crashes the WebSocket handler process (service unavailable until restart).
   • Triggers an unexpected device reboot (impacting ALL services—serial tunneling, Modbus gateway, HTTP management—not just WebSocket).

Attack Surface:

• Network-accessible WebSocket endpoint (no authentication bypass required; attacker needs valid low-privileged credentials, e.g., "user" or "operator" account).
• Default credentials remain enabled on many devices in production OT environments.
• The WebSocket API uses a custom subprotocol (e.g., moxa-serial, v2.command) with JSON-RPC-style methods (set_config, get_status, control_port), making the interface fingerprintable.

Code-Level Relevant Detail: The parser likely uses a generic JSON library (e.g., cJSON or JSMN) without recursion-depth guards. A standard exploit payload like {"a":{"a":{"a":... x10000 ...}}} will exceed the call stack, causing a segmentation fault. Alternatively, sending a payload with duplicate keys referencing each other ({"a":"b","b":"a"}) can trigger infinite iteration in certain parser implementations.

Exploitation Scenarios

Scenario: Remote Device Bricking via Crafted Configuration Request

1. Reconnaissance/Target Identification:

• The attacker scans the OT network segment (often using Shodan dorks like "Moxa" "NPort" port:443 or "moxa-httpd" port:80) to identify Moxa serial device servers.
• Fingerprint the WebSocket endpoint by sending a handshake: GET /ws HTTP/1.1 with Upgrade: websocket, Connection: Upgrade, and Sec-WebSocket-Protocol: moxa-command.
• If the server responds with 101 Switching Protocols, the target is confirmed vulnerable to the API.

2. Trigger/Weaponization:

• Authenticate as a low-privileged user. Default credentials (e.g., user/user or admin/moxa) are common.
• Establish a WebSocket connection and craft a malicious JSON payload targeting the set_config or control_port method. Example payload:

  {"method":"set_config","params":{"port":"1","data":{"nested":{"nested":{"nested":... (recursion repeated 20,000 times) ...}}}},"id":1}
  

• Alternatively, use a type-confusion trigger: {"method":"get_status","params":"string_instead_of_object","id":1}.

3. Payload/Execution:

• Send the payload as a single WebSocket binary text frame.
• The parser begins recursive descent; after ~5,000–10,000 nesting levels, the Python/C parser (depending on firmware) hits the recursion limit or stack overflow.
• The process crashes; the OS watchdog (typically 30–90 seconds) detects the hang and reboots the device.

4. Post-Exploitation Impact:

• Device reboots and remains offline for 1–3 minutes (boot time).
• If the attacker sends the payload repeatedly in a loop (e.g., every 10 seconds), the device enters a reboot loop, making it permanently unavailable.
• A reboot wipe of volatile configuration changes an attacker may have made—restoring factory defaults—which can disrupt serial port mappings, IP addresses, and firewall rules for downstream OT devices.

Additional Scenario: Denial of Service via Serial Port Flood

• The attacker uses the authenticated WebSocket API to switch a serial port into a loopback mode with no data framing, causing the device to transmit garbage data to connected PLCs/RTUs, inducing a cascading failure in the control loop.

Impact Assessment

CVSS Breakdown (3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H):

• AV:N (Network) — Exploitable from any reachable network position.
• AC:L (Low) — No special conditions; just valid credentials.
• PR:L (Low) — Requires a low-privileged account; default creds often sufficient.
• UI:N (None) — No user interaction.
• S:U (Unchanged) — Impact confined to the target device.
• A:H (High) — Complete loss of availability.

Business Impact:

• Availability: Total loss of the device’s serial-to-Ethernet gateway functionality. Every connected RS-232/RS-485 device (PLCs, HMIs, barcode scanners, industrial instruments) becomes unreachable.
• Operational Disruption: In manufacturing, a single device reboot can halt a production line for minutes; a reboot loop can halt it indefinitely.
• Safety: In critical infrastructure (water treatment, power distribution), inability to reach serial sensors can mask alarms or prevent emergency shutdown, escalating to safety incidents.
• Blast Radius: While the CVSS scope is Unchanged (single device), the functional blast radius includes all industrial equipment connected to the serial ports—potentially dozens of field devices.

Affected Systems:

• Moxa serial device server product lines (NPort 5000/6000/7000 series, MGate 5100/5200 series, and OnCell G3100 series) with firmware versions lacking the validation fix.
• Exact affected version range is not yet publicly disclosed; the CNA advisory (MPSA-268270) is the only source.

Detection Guidance

Sigma Rule

title: Moxa WebSocket JSON DoS - Deep Recursion Payload
id: 3e8f6d2a-1c4e-4b8f-9d0a-5b7e1c9f3a2d
status: experimental
description: Detects WebSocket traffic to Moxa devices containing deeply nested JSON indicating CVE-2026-10825 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-10825
    - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-268270-cve-2026-10825-improper-validation-of-input-vulnerability-in-serial-device-servers
author: Valtersit Threat Intel
date: 2026/03/15
logsource:
    category: webserver
    product: moxa
detection:
    selection_ws:
        http.response.body|contains: 'upgrade: websocket'
    selection_payload:
        ws.payload|contains: '\{"a":\{"a":' 
    selection_depth:
        ws.payload|length: '> 5000'
    condition: selection_ws and selection_payload and selection_depth
falsepositives:
    - Legitimate deep JSON configurations (very unlikely)
level: high

YARA Rule

rule Moxa_WebSocket_JSON_DoS_CVE_2026_10825 {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects deeply nested JSON payloads targeting Moxa WebSocket API"
        cve = "CVE-2026-10825"
        date = "2026-03-15"
        severity = "high"
    strings:
        $ws_handshake = "Sec-WebSocket-Protocol: moxa" ascii wide nocase
        $method_set = "\"method\":\"set_config\"" ascii wide
        $method_get = "\"method\":\"get_status\"" ascii wide
        $deep_nest = /\{\"a\"\:\{\"a\"\:\{\"a\"\:\{\"a\"\:\{\"a\"\:\{\"a\"\:/ ascii
        $repeated = /(\{\"key\"\:){50,}/ ascii
    condition:
        uint16(0) == 0x1A0A or  // PCAP file
        uint16(0) == 0x4D5A or  // PE
        any of them and ($deep_nest or $repeated)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"Moxa WebSocket JSON DoS Attempt CVE-2026-10825"; flow:established,to_server; http.header_names; content:"Upgrade|3a| websocket"; http.header_names; content:"Sec-WebSocket-Protocol|3a| moxa"; fast_pattern; content:"set_config"; http.request_body; depth:50; content:"{" within:100; threshold:type both, track by_src, count 5, seconds 10; classtype:attempted-dos; sid:3008250; rev:1; reference:cve,2026-10825;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where event.category == "network" and destination.port in (80, 443) and
     network.protocol == "websocket" and
     process.name : "*moxa*" and
     network.direction == "outbound"]
  [file where event.category == "file" and
     file.name : "ws_payload.tmp" and
     file.size > 5000 and
     file.extension == "json"]
  [process where process.name == "moxa_ws" and
     process.args : "*recursion*" or 
     process.exit_code == -11]  // SIGSEGV

Splunk SPL Query

index=ot_firewall sourcetype=moxa:logs
| where like(_raw, "%WebSocket%") AND like(_raw, "%set_config%") OR like(_raw, "%get_status%")
| rex field=_raw "payload_length=(?<payload_len>\d+)"
| where payload_len > 5000
| eval depth_check = if(mvcount(split(_raw, "{\"")) > 100, "possible_exploit", "normal")
| stats count by src_ip, dest_ip, depth_check, _time
| where depth_check == "possible_exploit"
| sort - _time
| table _time, src_ip, dest_ip, count

Wazuh OSSEC Rule

<rule id="100250" level="12">
  <decoded>websocket</decoded>
  <match>Moxa NPort</match>
  <regex>payload length exceeds maximum allowed value</regex>
  <description>CVE-2026-10825: Moxa WebSocket API DoS attempt - oversized JSON payload rejected</description>
  <group>moxa,iot,denial_of_service,</group>
  <mitre>
    <id>T1499</id>
  </mitre>
  <options>no_full_log</options>
</rule>

<rule id="100251" level="15">
  <if_sid>100250</if_sid>
  <match>reboot triggered</match>
  <description>CVE-2026-10825: Moxa device rebooted following WebSocket DoS</description>
  <group>moxa,iot,denial_of_service,impact,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed)

1. Immediate Mitigations (until patch is verified):

• Restrict Network Access: Use firewall rules to limit access to WebSocket ports (80/443/8080) only to trusted management IPs. Never expose Moxa devices to the internet.
• Disable Unused Accounts: Change all default credentials immediately. Enforce strong passwords on all user-level accounts.
• Disable WebSocket API (if possible): If the environment can operate without remote WebSocket management, disable the WebSocket service via the device's web console or CLI. This is the strongest immediate measure.
• Enable Audit Logging: Configure the device to syslog all WebSocket connection and request events to a central SIEM.

2. Patch/Upgrade Steps:

• Verify Patch Source: Since patch confidence is only 2/4, independently confirm the fix with Moxa support before deploying. Contact Moxa TAC with your device model and firmware version.
• Download and Apply: Obtain the fixed firmware from the official Moxa security advisory page (MPSA-268270). Verify the firmware SHA-256 checksum against the published hash.
• Test in Lab: Apply the firmware to a staging device. Verify the WebSocket API rejects deeply nested JSON and oversized payloads, and that normal serial operations remain unaffected.
• Rollout Procedure: Schedule a staged rollout, starting with non-critical devices. After each update, confirm the device boots correctly and communicates with serial endpoints.

3. Long-Term Hardening:

• Inventory Management: Maintain an up-to-date asset inventory of all Moxa devices, firmware versions, and patch status. Use the Moxa MXsecurity tool for centralized management.
• OT Network Segmentation: Place serial device servers in isolated OT network segments. Use a firewall or industrial DMZ to restrict bidirectional access.
• Default Credential Purge: Implement a policy to disable all default accounts on OT devices. Where device vendors do not allow removal, use unique, complex passwords.
• Continuous Monitoring: Deploy the Sigma/Suricata/Splunk detections above to flag anomalous WebSocket payloads. Correlate with device reboot logs.
• CVE Monitoring: Subscribe to Moxa security advisories via their RSS feed or CISA OT advisories. Re-evaluate the patch confidence when the fix is independently confirmed.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-10825

   • Contains the official CVE description, CVSS 3.1 score 7.1, and CWE-20 classification.

2. Moxa Security Advisory (MPSA-268270): https://www.moxa.com/en/support/product-support/security-advisory/mpsa-268270-cve-2026-10825-improper-validation-of-input-vulnerability-in-serial-device-servers

   • The single (CLAIMED) patch source. Not yet independently verified. Provides firmware fix details.

3. MITRE ATT&CK Technique Reference:

   • T1499 — Endpoint Denial of Service. Framework mapping for the attack's post-exploitation impact.
   • T1190 — Exploit Public-Facing Application (if device exposed to internet).

4. CISA Known Exploited Vulnerabilities Catalog: Not listed (as of publication date), indicating no confirmed in-the-wild exploitation was reported to CISA.

5. Exploitation Evidence Note): No known threat actor campaigns targeting CVE-2026-10825 have been identified. The EPSS percentile of 15.2% and the absence of KEV listing suggest that while exploitation is feasible, it is not currently part of widespread campaigns. However, the low required privilege (PR:L) combined with default credentials on legacy Moxa devices can make this a trivial initial-access vector for OT-focused ransomware groups or hacktivists. Organizations should treat this as a high-priority patching item even without observed exploitation.