PT-2025-54287 · Unknown · Serial Device Servers

Published 2025-12-31 · Updated 2025-12-31 · CVE-2025-15017

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions serial device servers (affected versions not specified)

Description A flaw exists in serial device servers where active debug code is enabled in the UART interface. An attacker with physical access can connect to the UART interface and gain unauthorized access to internal debug functionality without authentication or user interaction. This allows an attacker to execute privileged operations and access sensitive system resources, impacting the confidentiality, integrity, and availability of the device. There is no identified security impact to external or dependent systems. Exploitation is considered low complexity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-489

Related Identifiers

BDU:2026-00359

CVE-2025-15017

Affected Products

Serial Device Servers

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-15017 · Security Note
• https://moxa.com/en/support/product-support/security-advisory/mpsa-257331-cve-2025-15017-active-debug-code-vulnerability-in-serial-device-servers · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00359 · Security Note
• https://t.me/CVEtracker/41051 · Telegram Post
• https://twitter.com/CVEnew/status/2006332190452494708 · Twitter Post
• https://t.me/cveNotify/147300 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2006353627808408062 · Twitter Post