Moxa CVE-2026-86325, CVE-2026-86326: Two Vulnerabilities in Protocol Gateways

Plan PatchCVSS 9.4MPSA-269540Oct 2, 2026

Moxa

Summary

Two vulnerabilities exist in Moxa Protocol Gateways (all versions). CVE-2026-86325 is a stack-based buffer overflow in the account management interface caused by insufficient validation of the account_name parameter. A read-only user could supply a crafted account name exceeding the buffer size, corrupting program execution to steal credentials, modify memory, or crash the device. CVE-2026-86326 is improper verification of firmware image signatures; a high-privilege attacker could upload a modified firmware image without signature validation, allowing execution of unauthorized code and persistent compromise across reboots. No vendor patch is currently available for either vulnerability.

What this means

What could happen

An attacker with read-only access to the web management interface could corrupt the gateway's memory to steal credentials or crash the device. A privileged attacker could install malicious firmware that persists across reboots and executes unauthorized commands on your network.

Who's at risk

Water and electric utilities using Moxa Protocol Gateways for SCADA communication, legacy protocol conversion (Modbus, Profibus, Ethernet/IP), and industrial network management are affected. These gateways are commonly deployed in substations, water treatment plants, and generation facilities where they translate between modern and legacy control systems.

How it could be exploited

An attacker logs into the web management interface as a read-only user and submits a crafted account name to trigger a stack buffer overflow, allowing memory manipulation. Alternatively, a privileged attacker uploads a modified firmware image to the update interface, bypassing signature verification, to install persistent malicious code on the device.

Prerequisites

Network access to the web management interface (typically port 80/443)
Valid read-only user credentials (for CVE-2026-86325)
High-privilege credentials and access to the firmware update interface (for CVE-2026-86326)

remotely exploitableauthentication required (but low-privilege user can trigger CVE-2026-86325)low complexityno patch availablecritical CVSS (9.4)high EPSS scoreaffects protocol gateways in safety-critical infrastructure

Exploitability

Unlikely to be exploited — EPSS score 0.3%

Affected products (1)

ProductAffected VersionsFix Status

Protocol GatewaysAll versionsNo fix (EOL)

Remediation & Mitigation

0/5

Do now

0/3

WORKAROUNDRestrict access to the web management interface to trusted administrative networks only using firewall rules or ACLs

WORKAROUNDDisable the firmware update interface if not actively in use; require manual approval or administrative review before any firmware update is permitted

HARDENINGEnforce strong authentication on the management interface; review and revoke unnecessary read-only user accounts

Mitigations - no patch available

0/2

Protocol Gateways has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:

HARDENINGImplement network segmentation to isolate protocol gateways from untrusted network segments

HARDENINGMonitor for suspicious web management traffic (failed logins, unusual account names, firmware update attempts)

CVEs (2)

CVE-2026-86325 CVE-2026-86326

View full Moxa Security advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/a7357310-8c0e-4543-a42d-4092ebf6ccbb

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.