CVE-2026-15579

An out-of-bounds write vulnerability (CWE-787) exists in some Moxa Ethernet switches due to improper validation of the length of the username field during web login processing. A remote, unauthenticated attacker can trigger it by submitting a specially crafted, overly long username to the switch's web login page, causing a buffer overflow. The impact is a crash of the authentication process, resulting in a Denial of Service of the switch's web authentication — CVSS 4.0 scores availability impact as High, with no confidentiality and only low integrity impact. Any operator running an affected Moxa Ethernet switch model is affected, particularly where the web management interface is reachable from untrusted networks. As of now, the flaw is not listed in CISA KEV, no public proof-of-concept is known, and no exploitation has been reported.

What to do: Check Moxa's advisory for CVE-2026-15579 to identify whether your switch models are affected and upgrade to the fixed firmware the vendor specifies. Until patching, restrict access to the switches' web management interface to trusted management networks via ACLs, VLAN segmentation, or firewall rules, and disable web login on devices that are managed another way. Monitor for repeated crashes or unavailability of the switch's web authentication service, which would indicate exploitation attempts.