Moxa MRC Client and OnCell LTE devices hit by three flaws
Canada's Cyber Centre says MRC Client through v4.2.0 and all OnCell G3150A-LTE firmware are affected, with fixes not named.
46
Vulnerability1 · 1 read
CVE-2026-111459
Improper certificate validation in Moxa MRC Client
- CVSS 4.0
- 7.6 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Moxa Remote Connect Suite (MRC Client) does not properly validate certificates. An unauthenticated attacker on the path between the client and its server can impersonate a trusted server and intercept or alter traffic. The attack needs a present on-path position and passive user interaction. Confidentiality and integrity of those communications can be compromised.
What to do: Apply Moxa's update for CVE-2026-111459. Moxa has not listed a fixed version or workaround.
| Product | Affected |
|---|---|
| Moxa Remote Connect Suite (MRC Client) | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle attack, potentially compromising the confidentiality and integrity of communications.
- Weakness
- CWE-295
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X