CVE-2026-0715

Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An attacker with physical access to the device could use this information to access the bootloader menu via a serial interface.  Access to the bootloader menu does not allow full system takeover or privilege escalation. The bootloader enforces digital signature verification and only permits flashing of Moxa-signed images. As a result, an attacker cannot install malicious firmware or execute arbitrary code. The primary impact is limited to a potential temporary denial-of-service condition if a valid image is reflashed. Remote exploitation is not possible.

Score
CVSS 4.0 7.0 High
Status
Analyzed - psirt@moxa.com
Published
2026-02-05
Last modified
2026-02-05
Weaknesses
CWE-522

Affected products

References

 
 
© AVABIS GmbH privacypolicy about