Motorola vulnerabilities
We track 24 vulnerabilities in Motorola products across 20 products. 24 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on September 2, 2026.
Latest Motorola vulnerabilities
- 7.5 High severity
Smart Connect Application: Missing Authorization
The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in escalated privileges of an attacker within the system.
- 7.0 High severity
Software Fix: Uncontrolled Search Path Element
A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local attacker to escalate privileges during installation of the software.
- 8.0 High severity
cx2l_firmware: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability exists in Motorola CX2L router v1.0.2 and below. The vulnerability is present in the SetStationSettings function. The system directly invokes the system function to execute commands for setting parameters such as MAC address w
- 8.8 High severity
MR2600: Unrestricted Upload of File with Dangerous Type
An arbitrary firmware upload vulnerability exists in the Motorola MR2600. An attacker can exploit this vulnerability to achieve code execution on the device. Authentication is required, however can be bypassed.
- 7.5 High severity
MR2600: Improper Authentication
An authentication bypass vulnerability exists in the web component of the Motorola MR2600. An attacker can exploit this vulnerability to access protected URLs and retrieve sensitive information.
- 8.8 High severity
MR2600: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the 'SaveStaticRouteIPv6Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed.
- 8.8 High severity
MR2600: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the 'SaveStaticRouteIPv4Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed.
- 8.8 High severity
MR2600: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the ‘SaveSysLogParams’ parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed.
- 8.2 High severity
Mobile Radio: Improper Handling of Overlap Between Protected Memory Ranges
Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoC provides two memory protection units, MPU1 and MPU2, to enforce the trust boundary between the two cores. Since both u
- 8.8 High severity
Mobile Radio: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count register as its sole entropy source. Low boottime entropy and limited re-seeding of the pool renders the authentication challenge vulnerable to two a
- 8.2 High severity
Mobile Radio: Release of Invalid Pointer or Reference
The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules,
- 8.8 High severity
Mobile Radio: Use of Externally-Controlled Format String
A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is improperly handled, allowing for a write-anything-anywhere scenario. This can be leveraged to obtain arbitra
- 8.4 High severity
EBTS/MBTS Base Radio: Improper Handling of Exceptional Conditions
Motorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception. The Motorola MBTS Site Controller exposes a debug prompt on the device's serial port in case of an unhandled exception. This allows an attacker with physical access that is able t
- 8.8 High severity
EBTS/MBTS Base Radio: Improper Verification of Cryptographic Signature
Motorola EBTS/MBTS Base Radio fails to check firmware authenticity. The Motorola MBTS Base Radio lacks cryptographic signature validation for firmware update packages, allowing an authenticated attacker to gain arbitrary code execution, extract secret key mate
- 8.8 High severity
MBTS Site Controller: Improper Verification of Cryptographic Signature
Motorola MBTS Site Controller fails to check firmware update authenticity. The Motorola MBTS Site Controller lacks cryptographic signature validation for firmware update packages, allowing an authenticated attacker to gain arbitrary code execution, extract sec
- 8.4 High severity
MBTS Base Radio: Use of Hard-coded Credentials
Motorola MBTS Base Radio accepts hard-coded backdoor password. The Motorola MBTS Base Radio Man Machine Interface (MMI), allowing for service technicians to diagnose and configure the device, accepts a hard-coded backdoor password that cannot be changed or dis
- 9.8 Critical severity
MBTS Site Controller: Use of Hard-coded Credentials
Motorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing for service technicians to diagnose and configure the device, accepts a hard-coded backdoor password that cannot be chan
- 7.5 High severity
Moscad IP Gateway Firmware: Missing Authentication for Critical Functionality
The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 omit an authentication requirement. They feature IP Gateway modules which allow for interfacing between Motorola Data Link Communication (MDLC) networks (potentially over a variety of serial, RF and/o
- 9.8 Critical severity
Ace1000 Firmware: Use of Hard-coded Credentials
The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely. It can communicate with an XRT LAN-to-radio gateway by means of an embedded client. Credentials for accessing this gateway are stored after being encrypted with the Tiny Encryption Algor
- 7.2 High severity
Ace1000 Firmware: Insufficient Verification of Data Authenticity
The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity. It utilizes either the STS software suite or ACE1000 Easy Configurator for performing firmware updates. In case of the Easy Configurator, firmware updates are performed through access t
- 9.8 Critical severity
ace1000_firmware: Use of Hard-coded Credentials
The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_service) only generate a new key if no private-key file exists. Thus, this hardcoded key is likely to be used by default.
- 9.8 Critical severity
Ace1000 Firmware: Improper Authentication
The Motorola ACE1000 RTU through 2022-05-02 has default credentials. It exposes an SSH interface on port 22/TCP. This interface is used for remote maintenance and for SFTP file-transfer operations that are part of engineering software functionality. Access to
- 8.8 High severity
Ace1000 Firmware: Insufficient Verification of Data Authenticity
Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom application installation via either STS software, the C toolkit, or the ACE1000 Easy Configurator. In the case of the Easy Configurator, application images (as PLX/
- 7.8 High severity
Linux Kernel Integer Overflow Exploited
Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel mem