Moxa has 9 CVEs on record. Disclosure cadence is accelerating: 9 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 8. The median CVSS is 7.7 (high), with 1 rated critical. None have a confirmed exploitation report. Most affected products: AIG-302 Series (2), MGate MB3170 Series (2), OnCell G3150A-LTE Series (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.7
- Publish → KEV
- —
- Last 90 days
- 9 prev 0
Products
- AIG-302 Series 2
- MGate MB3170 Series 2
- OnCell G3150A-LTE Series 2
- Moxa Remote Connect Suite (MRC Client) 1
- NPort W2150A-W4/W2250A-W4 Series 1
- TN-4500B Series 1
Worst active — by depth score
CVE-2026-86325Critical· 9.4A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface52CVE-2026-15579High· 8.8An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing49CVE-2026-109813High· 8.6A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products47CVE-2026-86326High· 8.6An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation47CVE-2026-111461High· 7.5SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series42
Moxa vulnerabilities
CVEs affecting Moxa, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-111548Medium· 5.3A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers
A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers. An authenticated remote attacker with low privileges could exploit insufficient bounds checking of user-supplied…
CVE-2026-111461High· 7.5SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series
An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the …
CVE-2026-111460High· 7.7Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series
A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices t…
CVE-2026-111459High· 7.6Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client)
An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could…
CVE-2026-109813High· 8.6A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to comp…
CVE-2026-109812Medium· 6.9A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products
A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to…
CVE-2026-86326High· 8.6An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation
An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privil…
CVE-2026-86325Critical· 9.4A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface
A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account management reque…
CVE-2026-15579High· 8.8An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing
An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing. This may allow a remote attacker to submit a specially crafted overly l…