---
id: CVE-2026-3868
title: "An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router.\_Because of improper validation of length parameters in the HTTPS management interface, an unauthenticated remote attack…"
summary: "An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router.\_Because of improper validation of length parameters in the HTTPS management interface, an unauthenticated remote attack…"
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-130
vendor: Moxa
product: EDR-8010 Series
affected:
  - edr-8010_series >= 1.0 <= 3.23
  - edr-g9010_series >= 1.0 <= 3.23.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-04-27T15:13:55.314280Z'
published: '2026-04-27'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T06:12:49.479Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-3868'
references:
  - url: >-
      https://www.moxa.com/en/support/product-support/security-advisory/mpsa-261521-cve-2026-3867-cve-2026-3868-improper-ownership-management-and-improper-handling-of-length-parameter-incons
tags:
  - cve.org
epss: 0.00368
epssPercentile: 0.30866
ingestedAt: '2026-11-05T19:30:42.626Z'
---

## Overview

An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router. Because of improper validation of length parameters in the HTTPS management interface, an unauthenticated remote attacker could send specially crafted requests that trigger a buffer overflow condition, causing the web service to become unresponsive. Successful exploitation may result in a denial-of-service condition requiring a device reboot to restore normal operation. While successful exploitation can severely impact the availability of the affected device, no impact to the confidentiality or integrity of the affected product has been identified. Additionally, no confidentiality, integrity, or availability impact to the subsequent system has been identified.

## Affected

- `edr-8010_series >= 1.0 <= 3.23`
- `edr-g9010_series >= 1.0 <= 3.23.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.