MMOXA

Products

Exploited and recent CVEs

• CVE-2026-111548 Medium 5.3 A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers. An authenticated remote attacker with low privileges could exploit insuffic 0.3%
• CVE-2026-111461 High 7.5 SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series 1.4%
• CVE-2026-111460 High 7.7 Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series 0.3%
• CVE-2026-111459 High 7.6 Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client) 0.2%
• CVE-2026-109813 High 8.6 Shared Hard-coded Root CA Private Key 0.2%
• CVE-2026-109812 Medium 6.9 Missing Authorization on Secret Endpoints 0.1%
• CVE-2026-86326 High 8.6 An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before insta 0.2%
• CVE-2026-86326 High 8.6 An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before insta 0.2%
• CVE-2026-86325 Critical 9.4 A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter whe 0.3%
• CVE-2026-86325 Critical 9.4 A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter whe 0.3%
• CVE-2026-15579 High 8.8 An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing. This may allow a remote attacker t 0.7%
• CVE-2026-10831 Medium 6.9 Improper Authorization of Break Signal Commands in Devices 0.3%
• CVE-2026-10831 Medium 6.9 Improper Authorization of Break Signal Commands in Devices 0.3%
• CVE-2026-10829 High 8.6 A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier. This vulnerability stems from insufficient input validation of user-supplied 0.5%
• CVE-2026-10829 High 8.6 A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier. This vulnerability stems from insufficient input validation of user-supplied 0.5%
• CVE-2026-10828 Medium 6.9 A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior. This vulnerability stems fro 0.3%
• CVE-2026-10828 Medium 6.9 A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior. This vulnerability stems fro 0.3%
• CVE-2026-10825 High 7.1 Improper JSON Input Validation in WebSocket API Leads to Denial of Service 0.2%
• CVE-2026-9266 High 7.0 A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediat <0.1%
• CVE-2026-3868 High 8.7 An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router. Because of improper validation of length parameters in the HTTPS management interf 0.4%
• CVE-2026-3868 High 8.7 An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router. Because of improper validation of length parameters in the HTTPS management interf 0.4%
• CVE-2026-3867 Medium 6.0 An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may access a configuration fil 0.2%
• CVE-2026-3867 Medium 6.0 An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may access a configuration fil 0.2%
• CVE-2026-4483 High 7.0 An exposed IOCTL with an  insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x86 computers. The affected utility, MxGeneralIo, exposes IOC 0.3%
• CVE-2026-0715 High 7.0 Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An attacker with physical access to the device could use this i 0.2%
• CVE-2026-0714 High 7.0 A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Linux 3, where the discrete TPM is connected to the CPU via an 0.1%
• CVE-2025-15017 High 7.0 A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical access to the device can directly connect to the UART interface 0.3%
• CVE-2025-15017 High 7.0 A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical access to the device can directly connect to the UART interface 0.3%
• CVE-2025-15017 High 7.0 A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical access to the device can directly connect to the UART interface 0.3%
• CVE-2025-15017 High 7.0 A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical access to the device can directly connect to the UART interface 0.3%