Moxa NPort W2150A / W2250A wireless device server: The device ships with an empty default password, so anyone who can

Impact

The device ships with an empty default password, so anyone who can reach it on the network can log in as an unauthorized user with no credential at all and take over the serial device server.

Who can reach it

No authentication required — just network reachability to a device still running the default (blank) password.

What to do

Firmware upgrade past 1.11 plus setting a real administrator password on every device — the firmware fix stops shipping the box in an unauthenticated state, but existing deployed units also need someone to actually set a password during the upgrade. Track this as a fleet-wide credential-rotation project, not just a flash.

References