OTPulse

Moxa CVE-2026-15579: Out-of-bounds Write Vulnerability in Ethernet Switch

Plan PatchCVSS 8.8MPSA-252620Sep 18, 2026
Moxa
Summary

An out-of-bounds write vulnerability (CVE-2026-15579) exists in Moxa Ethernet switches due to improper validation of the username field length during Web login processing. A remote attacker can submit a specially crafted overly long username, triggering a buffer overflow that crashes the authentication process and causes a Denial of Service (DoS). The vulnerability allows unauthenticated remote exploitation over the network (CVSS 8.8).

What this means
What could happen
An attacker can send a specially crafted login request to crash the Ethernet switch's authentication process, causing the device to stop responding and disabling network connectivity for connected equipment. This is a denial-of-service attack with no legitimate workaround.
Who's at risk
Water utilities and municipalities operating Moxa Ethernet switches for SCADA network infrastructure, particularly those using Web-based management interfaces for remote configuration and monitoring of switches that connect industrial control devices, sensors, and RTUs.
How it could be exploited
An attacker on the network sends an overly long username during Web login to the switch. The improper validation in the authentication code fails to check input length, causing a buffer overflow that crashes the authentication process. The switch becomes unresponsive, denying network service to all connected devices.
Prerequisites
  • Network access to the Ethernet switch's Web interface (typically port 80/443)
  • No authentication required to trigger the vulnerability
remotely exploitableno authentication requiredlow complexityno patch availableaffects network availability for critical infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (1)
ProductAffected VersionsFix Status
Ethernet SwitchAll versionsNo fix yet
Remediation & Mitigation
0/4
Do now
0/2
HOTFIXContact Moxa technical support to request a firmware patch or timeline for availability, as no fix is currently documented
WORKAROUNDRestrict network access to the Ethernet switch Web interface using firewall rules—only allow login connections from authorized engineering workstations or management networks
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

WORKAROUNDDisable Web-based login if SNMP or command-line management is available as an alternative
Long-term hardening
0/1
HARDENINGImplement network segmentation to isolate the Ethernet switch on a separate management VLAN with strict access controls
View full Moxa Security advisory
API: /api/v1/advisories/1963a741-35ed-4a14-bf7e-79fccc3bc0bf

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.