Moxa vulnerabilities
We track 61 vulnerabilities in Moxa products across 60+ products. 61 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest Moxa vulnerabilities
- 7.5 High severity
OnCell G3150A-LTE Series: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the SMS management function
- 7.7 High severity
OnCell G3150A-LTE Series: Use of Hard-coded Cryptographic Key
A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerate
- 7.6 High severity
Moxa Remote Connect Suite (MRC Client): Improper Certificate Validation
An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted
- 8.6 High severity
AIG-302 Series: Use of Hard-coded Cryptographic Key
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidential
- 8.6 High severity
MGate MB3170 Series: Improper Verification of Cryptographic Signature
An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the
- 9.4 Critical severity
MGate MB3170 Series: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account management requests. An attacker authen
- 8.8 High severity
TN-4500B Series: Out-of-bounds Write
An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing. This may allow a remote attacker to submit a specially crafted overly long input, triggering a
- 8.6 High severity
NPort W2150A-W4/W2250A-W4 Series: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier. This vulnerability stems from insufficient input validation of user-supplied input in the "Server location" parameter on the Basic setti
- 7.1 High severity
NPort 6000-G2 Series: Improper Validation of Specified Type of Input
A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an u
- 7.0 High severity
UC-1200A Series: Missing Cryptographic Step
A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2 parameter
- 8.7 High severity
EDR-8010 Series: Improper Handling of Length Parameter Inconsistency
An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router. Because of improper validation of length parameters in the HTTPS management interface, an unauthenticated remote attacker could send specially
- 7.0 High severity
MxGeneralIo: Exposed IOCTL with Insufficient Access Control
An exposed IOCTL with an insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x86 computers. The affected utility, MxGeneralIo, exposes IOCTL methods that permit direct read and write access to MSR an
- 7.1 High severity
NPort 6100-G2/6200-G2 Series: Improper Null Termination
The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null byte injection through the device’s web API. This may lead to an unexpected device reboot and result in a denial-of-ser
- 7.7 High severity
NPort 6100-G2/6200-G2 Series: Execution with Unnecessary Privileges
The NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges vulnerability (CVE-2025-1977) that allows an authenticated user with read-only access to perform unauthorized configuration changes through the MCC (Moxa CLI Configuration
- 7.0 High severity
NPort 5000AI-M12 Series: Active Debug Code
A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical access to the device can directly connect to the UART interface and, without authentication, user interaction, or execution
- 9.9 Critical severity
EDR-G9010 Series: Use of Hard-coded Credentials
An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret key to sign JSON Web Tokens (JWT) used for authentication. This insecure implementation allows an unaut
- 9.3 Critical severity
EDR-G9010 Series: Execution with Unnecessary Privileges
An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A critical authorization flaw in the API allows an authenticated, low-privileged user to create a new administrator account, including
- 9.3 Critical severity
EDR-G9010 Series: Execution with Unnecessary Privileges
An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in broken access control has been identified in the /api/v1/setting/data endpoint of the affected device. This flaw allows a lo
- 8.7 High severity
EDR-G9010 Series: Incorrect Authorization
An Incorrect Authorization vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authentication mechanism allows unauthorized access to protected API endpoints, including those intended for administrative functi
- 7.3 High severity
Utility for DRP-A100 Series: Unquoted Search Path or Element
An Unquoted Search Path vulnerability has been identified in the utility for Moxa’s industrial computers (Windows). Due to the unquoted path configuration in the SerialInterfaceService.exe utility, a local attacker with limited privileges could place a malicio
- 8.6 High severity
EDF-G1002-BP Series: Improper Neutralization of Special Elements used in an OS Command
This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with console access to exploit improper input validation to inject and execute systems commands. Successful exploitation could result in privilege
- 9.2 Critical severity
EDF-G1002-BP Series: Improper Neutralization of Special Elements used in an OS Command
A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, leading to a total or p
- 7.5 High severity
PT-7728 Series: Out-of-bounds Write
Multiple switches are affected by an out-of-bounds write vulnerability. This vulnerability is caused by insufficient input validation, which allows data to be written to memory outside the bounds of the buffer. Successful exploitation of this vulnerability cou
- 9.2 Critical severity
EDS-508A Series: Reliance on Security Through Obscurity
Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. Th
- 9.8 Critical severity
EDR-8010 Series: Improper Neutralization of Special Elements used in an OS Command
Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. This vulnerability allows OS command injection due to improperly restricted commands, potentially enabling attackers to execute ar
- 7.2 High severity
EDR-810 Series: Reliance on Security Through Obscurity
Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This vulnerability involves hard-coded credentials, enabling an authenticated user to escalate privileges and gain root-level
- 7.5 High severity
VPort 07-3 Series: Improper Validation of Specified Type of Input
This vulnerability could lead to denial-of-service or service crashes. Exploitation of the moxa_cmd service, because of insufficient input validation, allows attackers to disrupt operations. If exposed to public networks, the vulnerability poses a significant
- 7.5 High severity
MXsecurity Series: Use of Hard-coded Credentials
MXsecurity software versions v1.1.0 and prior are vulnerable because of the use of hard-coded credentials. This vulnerability could allow an attacker to tamper with sensitive data.
- 7.5 High severity
MXsecurity Series: Exposed Dangerous Method or Function
The lack of access restriction to a resource from unauthorized users makes MXsecurity software versions v1.1.0 and prior vulnerable. By acquiring a valid authenticator, an attacker can pose as an authorized user and successfully access the resource.
- 9.4 Critical severity
EDR-8010 Series: Missing Authentication for Critical Functionality
The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuration files an
- 7.1 High severity
MXview One Series: Cleartext Storage of Sensitive Information
The configuration file stores credentials in cleartext. An attacker with local access rights can read or modify the configuration file, potentially resulting in the service being abused due to sensitive information exposure.
- 9.8 Critical severity
OnCell G3150A-LTE Series: Use of Externally-Controlled Format String
OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to accepting a format string from an external source as an argument. An attacker could modify an externally controlled format string to cause a memory leak and d
- 8.2 High severity
OnCell G3150A-LTE Series: Buffer Copy without Checking Size of Input
OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to missing bounds checking on buffer operations. An attacker could write past the boundaries of allocated buffer regions in memory, causing a program crash.
- 8.8 High severity
OnCell G3150A-LTE Series: Improper Neutralization of Special Elements used in a Command
OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in IPSec configuration. An attacker could modify the intended commands sent to target functions, which could cause malicious user
- 8.8 High severity
OnCell G3470A-LTE Series: Improper Neutralization of Special Elements used in a Command
OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in the web key upload function. An attacker could modify the intended commands sent to target functions, which could cause malici
- 8.3 High severity
NPort 5100A Series: Improper Neutralization of Input During Web Page Generation
The NPort 5100A Series firmware version v1.6 and prior versions are affected by web server XSS vulnerability. The vulnerability is caused by not correctly neutralizing user-controllable input before placing it in output. Malicious users may use the vulnerabili
- 7.5 High severity
NPort W2150A/W2250A Series: Out-of-bounds Write
A stack-based buffer overflow in the built-in web server in Moxa NPort W2150A/W2250A Series firmware version 2.3 and prior allows a remote attacker to exploit the vulnerability by sending crafted payload to the web service. Successful exploitation of the vulne
- 8.8 High severity
ioLogik E1200 Series: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be t
- 7.5 High severity
NPort 6000 Series: Improper Authentication
A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implementation of sensitive information protection, potentially allowing malicious users to gain unauthorized
- 7.5 High severity
EDR-810 Series: Buffer Copy without Checking Size of Input
A vulnerability has been identified in the EDR-810, EDR-G902, and EDR-G903 Series, making them vulnerable to the denial-of-service vulnerability. This vulnerability stems from insufficient input validation in the URI, potentially enabling malicious users to tr