Moxa

Latest CVEs · RSS

• CVE-2026-109813 2026-10-16 · CVSS 8.6
  A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with a
• CVE-2026-109812 2026-10-16 · CVSS 6.9
  A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authentica
• CVE-2026-86326 2026-10-02 · CVSS 8.6
  An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic auth
• CVE-2026-86325 2026-10-02 · CVSS 9.4
  A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length valida
• CVE-2026-15579 2026-09-18 · CVSS 8.8
  An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login proces
• CVE-2026-10831 2026-06-16 · CVSS 6.9
  A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does not properly valida
• CVE-2026-10829 2026-06-16 · CVSS 8.6
  A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier. This vulnerability stems from insuff
• CVE-2026-10828 2026-06-16 · CVSS 6.9
  A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5
• CVE-2026-10825 2026-06-16 · CVSS 7.1
  A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated
• CVE-2026-9266 2026-06-12 · CVSS 7.0
  A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnera
• CVE-2026-3868 2026-04-27 · CVSS 8.7
  An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router. Because of improper validation of length p
• CVE-2026-3867 2026-04-27 · CVSS 6.0
  An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authentic
• CVE-2026-4483 2026-04-08 · CVSS 7.0
  An exposed IOCTL with an  insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x86 computers. The af
• CVE-2026-0715 2026-02-05 · CVSS 7.0
  Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An attacker with physic
• CVE-2026-0714 2026-02-05 · CVSS 7.0
  A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Linux 3, where the dis
• CVE-2025-15017 2025-12-31 · CVSS 7.0
  A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical access to the device ca
• CVE-2025-2026 2025-12-31 · CVSS 7.1
  The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null byte injection thro
• CVE-2025-1977 2025-12-31 · CVSS 7.7
  The NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges vulnerability (CVE-2025-1977) that allows an authenticated user with re
• CVE-2025-9315 2025-12-10 · CVSS 6.3
  An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attributes, has been identif
• CVE-2025-1680 2025-10-23 · CVSS 0.0
  An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administ
• CVE-2025-1679 2025-10-23 · CVSS 4.8
  Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an af
• CVE-2025-6950 2025-10-17 · CVSS 9.9
  An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret key
• CVE-2025-6949 2025-10-17 · CVSS 9.3
  An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A critical authorization flaw in t
• CVE-2025-6894 2025-10-17 · CVSS 5.3
  An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authorization lo
• CVE-2025-6893 2025-10-17 · CVSS 9.3
  An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in broken access control ha