CVE-2026-111459High· 7.6▾ TwilightAn improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle attack, potentially compromising the confidentiality and integrity of communications.
remote_connect_suite_mrc_client >= 1.0.0 <= 4.2.0Please refer Moxa's security advisory: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269510-cve-2026-111459-cve-2026-111460-cve-2026-111461-vulnerabilities-in-moxa-remote-connect-suite-mrc-client
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111461High· 7.5SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series
CVE-2026-111460High· 7.7Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series
CVE-2026-111548Medium· 5.3A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers
CVE-2026-109813High· 8.6A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products
CVE-2026-109812Medium· 6.9A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products
CVE-2025-14022High· 7.7LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK