As of June 15, 2022, this site no longer supports Internet Explorer. Please use another browser for the best experience on our site.
Sign In
Home Support Security Advisories CVE-2025-5191: Unquoted Search Path Vulnerability in the Utility for Industrial Computers (Windows)

Product support

Security Advisories

Please sign in

Forgot your password?
Sign In
Remember Me.
Not a member? Sign up now
SUMMARY

CVE-2025-5191: Unquoted Search Path Vulnerability in the Utility for Industrial Computers (Windows)

This security advisory addresses one vulnerability identified in the utility for Moxa’s industrial computers (Windows).

CVE-2025-5191

An Unquoted Search Path vulnerability has been identified in the utility for Moxa’s industrial computers (Windows). Due to the unquoted path configuration in the SerialInterfaceService.exe utility, a local attacker with limited privileges could place a malicious executable in a higher-priority directory within the search path. When the Serial Interface service starts, the malicious executable could be run with SYSTEM privileges. Successful exploitation could allow privilege escalation or enable an attacker to maintain persistence on the affected system. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality, integrity, or availability within any subsequent systems.

Given the severity of the vulnerability, users are strongly advised to immediately apply the latest version of the utility that includes a fix for this issue to mitigate associated security risks.

 

The Identified Vulnerability Type and Potential Impact

CVE ID Vulnerability Type Impact
CVE-2025-5191

CWE-428: Unquoted Search Path or Element

 CAPEC-233: Privilege Escalation

Vulnerability Scoring Details 

CVE ID
Base Score
Vector
 Severity

Unauthenticated

Remote Exploits
CVE-2025-5191

CVSS:4.0: 7.3

AV:L/AC:L/AT:P/PR:L/UI:N/

VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

 High No
AFFECTED PRODUCTS AND SOLUTIONS

Solutions

Moxa has developed appropriate solutions to address this vulnerability. The solutions for the affected products are listed in the following table: 

Product Series Affected Versions Solutions

DRP-A100 Series

  • (Windows 10 IoT Enterprise LTSC 2021)
  • (Windows 11 IoT Enterprise LTSC 2024)
  • (Windows 11 Professional 2022)

Utility

  • v1.1 and earlier
  • v1.0 
  • v1.0 

Utility

DRP-C100 Series

  • (Windows 10 IoT Enterprise LTSC 2021)
  • (Windows 11 IoT Enterprise LTSC 2024)
  • (Windows 11 Professional 2022)

Utility

  • v1.1 and earlier
  • v1.0
  • v1.0

Utility

BXP-A100 Series

  • (Windows 11 Professional 2022)
  • (Windows 10 Enterprise LTSC 21H2)

Utility

  • v1.0
  • v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

BXP-A101 Series

  • (Windows 10 Enterprise LTSC 21H2)

Utility

  • v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

BXP-C100 Series

  • (Windows 10 IoT Enterprise LTSC 2021)
  • (Windows 11 Professional 2022)

Utility

  • v1.1 and earlier
  • v1.1 and earlier

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

DA-681C Series

  • (Windows 10 IoT Enterprise LTSC 2021)
  • (Windows 10 IoT Enterprise LTSC 2019)

Utility

  • v1.0
  • v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

DA-682C Series

  • (Windows 10 IoT Enterprise LTSC 2021)
  • (Windows 10 IoT Enterprise LTSC 2019)
  • (Windows 10 IoT Enterprise LTSC 2021 for DN-PRP-HSR-I210 module)
  • (Serial Interface and IO Controller)

Utility

  • v1.1 and earlier 
  • v1.1 and earlier 
  • v1.5 and earlier
  • v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

DA-720 Series

  • (Windows 10 IoT Enterprise LTSC 2021 for DE-PRP-HSR-EF module)
  • (Windows 10 IoT Enterprise LTSC 2021)
  • (SerialInterface for Windows 10)
  • (Windows 10 IoT Enterprise LTSC 2019/2021 for DE-2-IRIGB-4-DI/DO module)

Utility

  • v1.5 and earlier
  • v1.0
  • v1.0
  • v1.2 and earlier

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

DA-820C Series

  • (Windows Server 2022)
  • (Windows Server 2022 for expansion modules) 
  • (Windows 10 IoT Enterprise LTSC 2021)
  • (Windows 10 IoT Enterprise LTSC 2019 and Windows Server 2019)
  • (DN-PRP-HSR-I210 module)
  • (Windows 10 IoT Enterprise LTSC 2021 for DA-PRP-HSR-I210 module)

Utility

  • v1.0
  • v1.0
  • v1.1 
  • v1.1
  • v1.5
  • v1.5

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

DA-820E Series

  • (Windows 11 IoT Enterprise LTSC 2024)
  • (Windows 10 IoT Enterprise LTSC 2021)
  • (Windows Server 2022 for Expansion Modules)
  • (Windows 11 IoT Enterprise LTSC 2024 for Expansion Modules)
  • (Windows 10 IoT Enterprise LTSC 2021 for Expansion Modules)
  • (Windows Server 2022)

Utility

  • v1.0
  • v1.0
  • v1.0
  • v1.0
  • v1.0
  • v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

MC-1100 Series

  • (Windows 10 IoT Enterprise LTSC 2021)
  • (Tools for Windows Embedded Standard 7)

Utility

  • v1.0
  • v1.1 and earlier

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

MC-1200 Series

  • (SerialInterface, IOController, and PCIEPowerService)

Utility

  • v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe) 

MC-3201 Series

  • (Windows 10 IoT Enterprise LTSC 2019)
  • (Windows 10 IoT Enterprise LTSC 2021)

Utility

  • v1.0
  • v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)
MC-7400 Series Utility v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

RKP-A110 Series

  • (Windows 11 IoT Enterprise LTSC 2024)
  • (Windows 11 Professional 2022)
  • (Windows 10 IoT Enterprise LTSC 2021)

Utility

  • v1.0
  • v1.1 and earlier
  • v1.1 and earlier

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

RKP-C110 Series

  • (Windows 11 IoT Enterprise LTSC 2024)
  • (Windows 10 IoT Enterprise LTSC 2021)
  • (Windows 11 Professional 2022)

Utility

  • v1.0
  • v1.0
  • v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

V2201 Series

  • (Windows 7 Embedded)

Utility

  • v1.1 and earlier 

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

V2403C Series

  • (Windows 10)

Utility

  • v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

V2406C Series

  • (Windows 10 Enterprise LTSC 21H2)
  • (Windows 10)

Utility

  • v1.0
  • v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

V3200 Series

  • (Windows 10 Enterprise LTSC 21H2)

Utility

  • v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

V3400 Series

  • (Windows 10 Enterprise LTSC 21H2)
  • (Windows 11 Enterprise LTSC 24H2)

Utility

  • v1.0
  • v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

EXPC-F2000 Series *

  • (Windows 10 IoT Enterprise LTSC 21H2)
  • (Windows 11 Professional 2023)

* Note: EXPC-F2120W Series, EXPC-F2150W Series

Utility

  • v1.0
  • v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

MPC-2070 Series

  • (Windows 7)
  • (Windows 10 IoT Enterprise LTSC 2021)
  • (Windows 10 IoT Enterprise LTSC 2019)
  • (SerialInterface)
  • (MxOSD)

Utility

  • v1.0
  • v1.1 and earlier
  • v1.1 and earlier
  • v1.0
  • v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

MPC-2121 Series

  • (Windows 7)

Utility

  • v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

MPC-3000 Series *

  • (Windows 10 IoT Enterprise LTSC 21H2)
  • (Windows 11 Professional 2023)

* Note: MPC-3100 Series, MPC-3120 Series, MPC-3150 Series, MPC-3070W Series, MPC-3120W Series, MPC-3150W Series

Utility

  • v1.0
  • v1.0

Please contact Moxa Technical Support for the security patch

(SerialInterfaceSetup-6.6.0.exe)

 

Mitigations

To mitigate the risk associated with the vulnerability, we recommend the following actions:

  • Refer to the General Security Recommendations section to further strengthen your security context.

 

General Security Recommendations

To safeguard devices and networks, we recommend implementing the following recommendations to mitigate potential risks:

  1. Restrict Network Access
    • Use firewalls or access control lists (ACLs) to limit communication to trusted IP addresses and networks.
    • Segregate operational networks from other networks (e.g., enterprise networks) using VLANs or physical separation.
  2. Minimize Exposure
    • Avoid exposing devices directly to the Internet.
    • Disable unused network services and ports to reduce the attack surface.
  3. Enhance Device Authentication and Access Control
    • Implement multi-factor authentication (MFA) for accessing critical systems.
    • Use role-based access control (RBAC) to enforce the principle of least privilege.
  4. Regularly Update Firmware and Software
    • Keep devices updated with the latest firmware versions and security patches.
    • Establish a regular patch management schedule to address newly identified vulnerabilities.
  5. Secure Remote Access
    • Use encrypted communication protocols (e.g., VPN, SSH) for remote access.
    • Restrict remote access to authorized personnel only and enforce strong authentication mechanisms.
  6. Implement Anomaly Detection Techniques
    • Monitor network traffic and device behavior for unusual or unauthorized activities.
    • Use tools or techniques that can identify anomalies and provide alerts for potential threats.
  7. Implement Logging and Monitoring
    • Enable event logging and maintain audit trails on devices.
    • Regularly review logs for anomalies and unauthorized access attempts.
  8. Conduct Regular Security Assessments
    • Perform vulnerability assessments to identify potential risks.
    • Regularly review device configurations to ensure compliance with security policies.

 

Acknowledgement

We would like to express our gratitude to Anni Tuulinen for reporting the vulnerability, collaborating with us to enhance the security of our products, and contributing to our efforts to deliver better service to our customers. 

 

Revision History:

VERSION DESCRIPTION RELEASE DATE
1.0 First release August 25, 2025

Relevant Products

BXP-A100 Series · BXP-A101 Series · BXP-C100 Series · DA-681C Series · DA-682C Series · DA-720 Series · DA-820C Series · DA-820E Series · DRP-A100 Series · DRP-C100 Series · EXPC-F2120W Series · EXPC-F2150W Series · MC-1100 Series · MC-1200 Series · MC-3201 Series · MC-7400 Series · MPC-2070 Series · MPC-2121 Series · MPC-3070W Series · MPC-3100 Series · MPC-3120 Series · MPC-3120W Series · MPC-3150 Series · MPC-3150W Series · RKP-A110 Series · RKP-C110 Series · V2201 Series · V2403C Series · V2406C Series · V3200 Series · V3400 Series ·

  •   Print this page

  • Save
    You can manage and share your saved list in My Moxa
Let’s get that fixed

If you are concerned about a potential cybersecurity vulnerability, please contact us and one of technical support staff will get in touch with you.

Report a Vulnerability

Do Not Share My Personal Information

To opt out of sharing your personal information for cross-context behavioral advertising, you can complete and submit the form provided below.


Please note that even if you choose to complete the form, you may still see our ads on other websites. However, these ads may not be as relevant to you as they would be if you had not opted out.

 
 
Added To Bag

View Bag
You have some items waiting in your bag; click here to finish your quote!

You are currently on the Global / English site.
Would you like to go to the site for your region?

Feedback