[Control Systems] Moxa security advisory (AV26-995)
Canada’s Cyber Centre warned that Moxa MGate 3000 and 5000 gateways are affected by two vulnerabilities.
38
Vulnerability9 · 1 read
CVE-2026-86325
Stack buffer overflow in Moxa protocol gateway accounts
- CVSS 4.0
- 9.4 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-86325 is a critical stack-based buffer overflow (CWE-121) in the account management interface of Moxa protocol gateways. A user who is already authenticated to the web management interface, including with a read-only account, can send an account_name value that is not length-checked and overflows an internal stack buffer, corrupting program execution. Successful exploitation can expose sensitive data in device memory, including credentials, allow arbitrary memory modification, and disrupt device availability. The flaw is network-reachable with low privileges and no user interaction, and it is rated CVSS 4.0 9.4. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Restrict the web management interface to trusted management networks and do not expose it to the internet. Limit account creation to trusted administrators and treat read-only web accounts as privileged until Moxa publishes a fix. Apply the vendor patch for the affected protocol gateway models as soon as it is available, and review device logs for unexpected account-management requests.
| Product | Affected |
|---|---|
| Moxa Protocol gateways (account management web interface) | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account management requests. An attacker authenticated as a read-only user to the web management interface could supply a specially crafted account name that exceeds the size of the internal stack buffer, resulting in corruption of program execution flow. Successful exploitation could allow an attacker to read sensitive information from device memory, including credentials, modify arbitrary memory contents, and disrupt device availability.
- Weakness
- CWE-121
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X