Moxa NPort IA5000-G2 1.0 UART Interface debug code

Summaryinfo

A vulnerability was found in Moxa NPort 5000AI-M12, NPort 5100, NPort 5100A, NPort 5200, NPort 5200A, NPort 5400, NPort 5600, NPort 5600-DT, NPort IA5000, NPort IA5000A and NPort IA5000-G2 1.0. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component UART Interface. Performing a manipulation results in debug code. This vulnerability is identified as CVE-2025-15017. The attack may be carried out on the physical device. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in Moxa NPort 5000AI-M12, NPort 5100, NPort 5100A, NPort 5200, NPort 5200A, NPort 5400, NPort 5600, NPort 5600-DT, NPort IA5000, NPort IA5000A and NPort IA5000-G2 1.0. This affects an unknown code block of the component UART Interface. The manipulation with an unknown input leads to a debug code vulnerability. CWE is classifying the issue as CWE-489. The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical access to the device can directly connect to the UART interface and, without authentication, user interaction, or execution conditions, gain unauthorized access to internal debug functionality. Exploitation is low complexity and allows an attacker to execute privileged operations and access sensitive system resources, resulting in a high impact to the confidentiality, integrity, and availability of the affected device. No security impact to external or dependent systems has been identified.

The advisory is shared at moxa.com. This vulnerability is uniquely identified as CVE-2025-15017 since 12/22/2025. The exploitability is told to be easy. An attack has to be approached locally. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at EUVD (EUVD-2025-205900) and CERT Bund (WID-SEC-2025-2937). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Moxa NPort

Productinfo

Type

• Automation Software

Vendor

• Moxa

Name

• NPort 5000AI-M12
• NPort 5100
• NPort 5100A
• NPort 5200
• NPort 5200A
• NPort 5400
• NPort 5600
• NPort 5600-DT
• NPort IA5000
• NPort IA5000-G2
• NPort IA5000A

Version

• 1.0

License

• commercial

Website

• Vendor: https://www.moxa.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion