Moxa vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-111461 An OS command injection vulnerability exists in OnCell G3150A-LTE Series.High 7.5 · Oct 27, 2026
• CVE-2026-111460 A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series.High 7.7 · Oct 27, 2026
• CVE-2026-111459 An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client).High 7.6 · Oct 27, 2026
• CVE-2026-109813 A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products.High 8.6 · Oct 15, 2026
• CVE-2026-86326 An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authHigh 8.6 · Oct 2, 2026
• CVE-2026-86325 A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface.Critical 9.4 · Oct 2, 2026
• CVE-2026-15579 An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login procesHigh 8.8 · Sep 18, 2026
• CVE-2026-10829 A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier.High 8.6 · Jun 16, 2026
• CVE-2026-10825 A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests.High 7.1 · Jun 16, 2026
• CVE-2026-9266 A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers.High 7 · Jun 12, 2026
• CVE-2026-3868 An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router.High 8.7 · Apr 27, 2026
• CVE-2026-4483 An exposed IOCTL with an  insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x86 computers.High 7 · Apr 8, 2026
• CVE-2026-0715 Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device.High 7 · Feb 5, 2026
• CVE-2026-0714 A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Linux 3, where the disHigh 7 · Feb 5, 2026
• CVE-2025-2026 The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null byte injection throHigh 7.1 · Dec 31, 2025
• CVE-2025-1977 The NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges vulnerability (CVE-2025-1977) that allows an authenticated user with reHigh 7.7 · Dec 31, 2025
• CVE-2025-15017 A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface.High 7 · Dec 31, 2025
• CVE-2025-6950 An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers.Critical 9.9 · Oct 17, 2025
• CVE-2025-6949 An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers.Critical 9.3 · Oct 17, 2025
• CVE-2025-6893 An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers.Critical 9.3 · Oct 16, 2025
• CVE-2025-6892 An Incorrect Authorization vulnerability has been identified in Moxa’s network security appliances and routers.High 8.7 · Oct 16, 2025
• CVE-2025-5191 An Unquoted Search Path vulnerability has been identified in the utility for Moxa’s industrial computers (Windows).High 7.3 · Aug 25, 2025
• CVE-2025-0676 This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with console access to exploit improper input High 8.6 · Apr 2, 2025
• CVE-2025-0415 A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings.Critical 9.2 · Apr 2, 2025
• CVE-2024-7695 Multiple switches are affected by an out-of-bounds write vulnerability.High 8.7 · Jan 29, 2025