A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.
CVE-2026-109812 is a missing authorization vulnerability in the internal API `/api/v1/secrets/` of Moxa AIG-302 Series industrial computing products. It allows a low-privileged authenticated attacker with adjacent network access to potentially access sensitive information, including cryptographic key material. The vulnerability affects versions from 1.0.0 through 1.4.0. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provide a specially crafted or modified firmware image, causing it to be installed on the device. Successful exploitation could allow the attacker to execute unauthorized code, compromise the integrity and availability of the device, and persist malicious modifications across subsequent firmware updates.
An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing. This may allow a remote attacker to submit a specially crafted overly long input, triggering a buffer overflow that can cause the authentication process to crash and result in a Denial of Service (DoS) attack.
CVE-2026-10831 is a medium severity denial-of-service vulnerability in Moxa NPort 6000 Series devices. It arises from missing authorization checks on the command port, allowing remote attackers to disrupt serial communication by sending crafted break signal commands without proper session validation. This affects version 1.0 of the product. No official patch or remediation guidance is currently available.
A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier. This vulnerability stems from insufficient input validation of user-supplied input in the "Server location" parameter on the Basic settings page. An attacker could exploit this vulnerability by sending crafted input to the web service, resulting in memory corruption. Successful exploitation of this vulnerability could allow remote code execution on the target system with root privileges.
A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior. This vulnerability stems from insufficient input validation and improper handling of externally supplied format strings. An attacker could exploit this vulnerability by sending crafted input to the web service, causing unintended memory disclosure. Successful exploitation may allow an attacker to leak sensitive memory contents and determine critical memory addresses, potentially bypassing Address Space Layout Randomization (ASLR) protections.
A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reboot.
A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2 parameter encryption as a countermeasure against CVE-2026-0714. However, an omission in the authorization session configuration causes the parameter encryption to provide no effective protection. An attacker with invasive physical access to the device can still capture TPM communications on the SPI bus and derive the LUKS disk encryption key in plaintext. While successful exploitation results in full compromise of the encrypted disk volume, the attack requires invasive physical access, including opening the device and attaching external equipment to the SPI bus. Remote exploitation is not possible, and the attack does not affect any downstream systems.
CVE-2026-3868 is a high-severity vulnerability in the Moxa EDR-8010 Series Secure Router. It involves improper handling of length parameter inconsistencies in the HTTPS management interface, allowing an unauthenticated remote attacker to trigger a buffer overflow. Exploitation results in the web service becoming unresponsive, causing a denial-of-service condition that requires a device reboot to recover. There is no impact on confidentiality or integrity of the device or connected systems. No patch or official remediation has been confirmed at this time.
CVE-2026-3867 is an improper ownership management vulnerability in Moxa EDR-8010 Series Secure Router version 1.0. It allows a low-privileged authenticated user to access a configuration file containing the hashed password of the administrative account, but only if the configuration file has been exported. The vulnerability does not affect the integrity or availability of the product, nor does it impact the confidentiality, integrity, or availability of connected systems. Exploitation requires specific conditions and user privileges.
CVE-2026-4483 is a high-severity vulnerability in Moxa's MxGeneralIo utility for industrial x86 computers. It involves an exposed IOCTL interface with insufficient access control, allowing local attackers with high privileges to perform unauthorized read/write operations on MSR and system memory. Exploitation can lead to privilege escalation on Windows 7 or cause system crashes (BSoD) on Windows 10 and 11, resulting in denial-of-service. The vulnerability primarily impacts system availability, with minor effects on confidentiality and integrity. No patch or official remediation has been confirmed yet.
Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An attacker with physical access to the device could use this information to access the bootloader menu via a serial interface. Access to the bootloader menu does not allow full system takeover or privilege escalation. The bootloader enforces digital signature verification and only permits flashing of Moxa-signed images. As a result, an attacker cannot install malicious firmware or execute arbitrary code. The primary impact is limited to a potential temporary denial-of-service condition if a valid image is reflashed. Remote exploitation is not possible.
A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Linux 3, where the discrete TPM is connected to the CPU via an SPI bus. Exploitation requires invasive physical access, including opening the device and attaching external equipment to the SPI bus to capture TPM communications. If successful, the captured data may allow offline decryption of eMMC contents. This attack cannot be performed through brief or opportunistic physical access and requires extended physical access, possession of the device, appropriate equipment, and sufficient time for signal capture and analysis. Remote exploitation is not possible.
CVE-2025-15017 is a high-severity vulnerability affecting Moxa NPort 5000AI-M12 Series serial device servers, where active debug code remains enabled on the UART interface. An attacker with physical access can connect directly to the UART interface and gain unauthorized privileged access without authentication or user interaction. This allows execution of privileged operations and access to sensitive system resources, severely impacting confidentiality, integrity, and availability of the device. Exploitation complexity is low, but no remote exploitation or impact on external systems has been identified. The vulnerability affects version 1.0 of the product and has a CVSS 4.0 score of 7.0. No known exploits are currently in the wild, and no patches have been published yet. European organizations using these devices in critical infrastructure or industrial environments should prioritize physical security and monitor for updates from the vendor.
CVE-2025-2026 is a high-severity vulnerability affecting Moxa NPort 6100-G2/6200-G2 Series devices. It involves improper null termination in the device’s web API, allowing authenticated remote attackers with read-only web privileges to perform null byte injection. Exploiting this flaw can cause the device to reboot unexpectedly, leading to a denial-of-service (DoS) condition. The vulnerability requires no user interaction and has a CVSS score of 7.1, indicating significant risk. Although no known exploits are currently in the wild, the impact on availability is substantial for operational environments relying on these devices. European organizations using these serial device servers in industrial or critical infrastructure settings could face operational disruptions. Mitigation involves restricting access to the web API, applying vendor patches when available, and monitoring device behavior for unexpected reboots. Countries with strong industrial automation sectors and critical infrastructure deployments of Moxa products, such as Germany, France, and the UK, are most likely to be affected.
CVE-2025-1977 is a high-severity vulnerability affecting Moxa NPort 6100-G2/6200-G2 Series devices, allowing authenticated users with read-only access to perform unauthorized configuration changes via the MCC tool. Exploitation requires low attack complexity, no user interaction, and can be done remotely over the network, but depends on specific system configurations. Successful exploitation can compromise device confidentiality, integrity, and availability by enabling privilege escalation beyond intended user roles. No impact on other connected systems has been reported. The vulnerability does not have known exploits in the wild yet. European organizations using these devices in critical infrastructure or industrial environments should prioritize mitigation. Patch availability is not indicated, so alternative controls are necessary. The vulnerability has a CVSS 4.0 score of 7.7, reflecting its high risk due to network attack vector and privilege escalation potential.
An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attributes, has been identified in the MXsecurity Series. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted JSON payload to the device's registration endpoint /api/v1/devices/register, allowing the attacker to register unauthorized devices without authentication. Although exploiting this vulnerability has limited modification of data, there is no impact to the confidentiality and availability of the affected device, as well as no loss of confidentiality, integrity, and availability within any subsequent systems.
Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an affected device’s web service that could impact authenticated users interacting with the device’s web interface. This vulnerability is classified as stored cross-site scripting (XSS); attackers inject malicious scripts into the system, and the scripts persist across sessions. There is no impact to the confidentiality, integrity, and availability of the affected device; no loss of availability within any subsequent systems but has some loss of confidentiality and integrity within the subsequent system.
An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret key to sign JSON Web Tokens (JWT) used for authentication. This insecure implementation allows an unauthenticated attacker to forge valid tokens, thereby bypassing authentication controls and impersonating any user. Exploitation of this vulnerability can result in complete system compromise, enabling unauthorized access, data theft, and full administrative control over the affected device. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality or integrity within any subsequent systems.
