Vulnerability-Lookup

CERTFR-2026-AVI-1250

Vulnerability from certfr_avis - Published: 2026-10-02 - Updated: 2026-10-02

De multiples vulnérabilités ont été découvertes dans les produits Moxa. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Moxa	MGate MB3480 Series	MGate MB3480 Series versions antérieures à v4.5.1, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate 5114 Series	MGate 5114 Series toutes versions, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate 5216 Series	MGate 5216 Series toutes versions, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate W5208 Series	MGate W5208 Series toutes versions, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate 5119 Series	MGate 5119 Series toutes versions, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate 5101-PBM-MN Series	MGate 5101-PBM-MN Series toutes versions, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate MB3170 Series	MGate MB3170 Series versions antérieures à v4.7.1, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate 5102-PBM-PN Series	MGate 5102-PBM-PN Series toutes versions, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate MB3280 Series	MGate MB3280 Series versions antérieures à v4.6.3, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate 5111 Series	MGate 5111 Series toutes versions, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate 5217 Series	MGate 5217 Series versions antérieures à v1.5.5, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate MB3180 Series	MGate MB3180 Series versions antérieures à v2.7.1, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate 5105-MB-EIP Series	MGate 5105-MB-EIP Series toutes versions, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate EIP3170 Series	MGate EIP3170 Series toutes versions, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate 5109 Series	MGate 5109 Series toutes versions, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate 5103 Series	MGate 5103 Series toutes versions, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate MB3660 Series	MGate MB3660 Series versions antérieures à v3.4.5, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate 5118 Series	MGate 5118 Series toutes versions, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate W5108 Series	MGate W5108 Series toutes versions, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate EIP3270 Series	MGate EIP3270 Series toutes versions, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326
Moxa	MGate MB3270 Series	MGate MB3270 Series versions antérieures à v4.7.1, se référer au bulletin de sécurité de l'éditeur pour l'application du contournement provisoire pour la vulnérabilité CVE-2026-86326

References

Title

Publication Time

Tags

Bulletin de sécurité Moxa MPSA-269540

2026-10-02

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "MGate MB3480 Series versions ant\u00e9rieures \u00e0 v4.5.1, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate MB3480 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate 5114 Series toutes versions, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate 5114 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate 5216 Series toutes versions, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate 5216 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate W5208 Series toutes versions, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate W5208 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate 5119 Series toutes versions, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate 5119 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate 5101-PBM-MN Series toutes versions, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate 5101-PBM-MN Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate MB3170 Series versions ant\u00e9rieures \u00e0 v4.7.1, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate MB3170 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate 5102-PBM-PN Series toutes versions, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate 5102-PBM-PN Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate MB3280 Series versions ant\u00e9rieures \u00e0 v4.6.3, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate MB3280 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate 5111 Series toutes versions, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate 5111 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate 5217 Series versions ant\u00e9rieures \u00e0 v1.5.5, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate 5217 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate MB3180 Series versions ant\u00e9rieures \u00e0 v2.7.1, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate MB3180 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate 5105-MB-EIP Series toutes versions, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate 5105-MB-EIP Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate EIP3170 Series toutes versions, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate EIP3170 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate 5109 Series toutes versions, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate 5109 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate 5103 Series toutes versions, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate 5103 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate MB3660 Series versions ant\u00e9rieures \u00e0 v3.4.5, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate MB3660 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate 5118 Series toutes versions, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate 5118 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate W5108 Series toutes versions, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate W5108 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate EIP3270 Series toutes versions, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate EIP3270 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "MGate MB3270 Series versions ant\u00e9rieures \u00e0 v4.7.1, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027application du contournement provisoire pour la vuln\u00e9rabilit\u00e9 CVE-2026-86326",
      "product": {
        "name": "MGate MB3270 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-86326",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86326"
    },
    {
      "name": "CVE-2026-86325",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86325"
    }
  ],
  "initial_release_date": "2026-10-02T00:00:00",
  "last_revision_date": "2026-10-02T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1250",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-02T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Moxa. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Moxa",
  "vendor_advisories": [
    {
      "published_at": "2026-10-02",
      "title": "Bulletin de s\u00e9curit\u00e9 Moxa MPSA-269540",
      "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269540-cve-2026-86325,-cve-2026-86326-two-vulnerabilities-in-protocol-gateways"
    }
  ]
}

CVE-2026-86325 (GCVE-0-2026-86325)

Vulnerability from cvelistv5 – Published: 2026-10-02 10:18 – Updated: 2026-10-02 10:49

Summary

A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account management requests. An attacker authenticated as a read-only user to the web management interface could supply a specially crafted account name that exceeds the size of the internal stack buffer, resulting in corruption of program execution flow. Successful exploitation could allow an attacker to read sensitive information from device memory, including credentials, modify arbitrary memory contents, and disrupt device availability.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 10:49 UTC

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

Moxa icscert root Scorecard

References

1 reference

URL	Tags
https://www.moxa.com/en/support/product-support/s…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Moxa	MGate MB3170 Series	Affected: 1.0 , ≤ 4.7 (custom) cpe:2.3:a:moxa:mgate_mb3170_series::::::::
Moxa	MGate MB3270 Series	Affected: 1.0 , ≤ 4.7 (custom) cpe:2.3:a:moxa:mgate_mb3270_series::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86325",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T10:49:27.817598Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T10:49:43.686Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MGate MB3170 Series",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "4.7",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MGate MB3270 Series",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "4.7",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:moxa:mgate_mb3170_series:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "4.7",
                  "versionStartIncluding": "1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:moxa:mgate_mb3270_series:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "4.7",
                  "versionStartIncluding": "1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A stack-based buffer overflow vulnerability exists in protocol gateways\u0027 account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account management requests. An attacker authenticated as a read-only user to the web\u0026nbsp;management interface could supply a specially crafted account name that exceeds the size of the internal stack buffer, resulting in corruption of program execution flow. Successful exploitation could allow an attacker to read sensitive information from device memory, including credentials, modify arbitrary memory contents, and disrupt device availability."
            }
          ],
          "value": "A stack-based buffer overflow vulnerability exists in protocol gateways\u0027 account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account management requests. An attacker authenticated as a read-only user to the web\u00a0management interface could supply a specially crafted account name that exceeds the size of the internal stack buffer, resulting in corruption of program execution flow. Successful exploitation could allow an attacker to read sensitive information from device memory, including credentials, modify arbitrary memory contents, and disrupt device availability."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-24",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-24: Filter Failure through Buffer Overflow"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T10:18:29.907Z",
        "orgId": "2e0a0ee2-d866-482a-9f5e-ac03d156dbaa",
        "shortName": "Moxa"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269540-cve-2026-86325,-cve-2026-86326-two-vulnerabilities-in-protocol-gateways"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Moxa has developed appropriate solutions to address the vulnerability:\u0026nbsp;https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269540-cve-2026-86325,-cve-2026-86326-two-vulnerabilities-in-protocol-gateways"
            }
          ],
          "value": "Moxa has developed appropriate solutions to address the vulnerability:\u00a0https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269540-cve-2026-86325,-cve-2026-86326-two-vulnerabilities-in-protocol-gateways"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2e0a0ee2-d866-482a-9f5e-ac03d156dbaa",
    "assignerShortName": "Moxa",
    "cveId": "CVE-2026-86325",
    "datePublished": "2026-10-02T10:18:29.907Z",
    "dateReserved": "2026-09-07T06:34:02.910Z",
    "dateUpdated": "2026-10-02T10:49:43.686Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86326 (GCVE-0-2026-86326)

Vulnerability from cvelistv5 – Published: 2026-10-02 10:21 – Updated: 2026-10-02 10:39

Summary

An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provide a specially crafted or modified firmware image, causing it to be installed on the device. Successful exploitation could allow the attacker to execute unauthorized code, compromise the integrity and availability of the device, and persist malicious modifications across subsequent firmware updates.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 10:37 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

Moxa icscert root Scorecard

References

1 reference

URL	Tags
https://www.moxa.com/en/support/product-support/s…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Moxa	MGate MB3170 Series	Affected: 1.0 cpe:2.3:a:moxa:mgate_mb3170_series:1.0:::::::*
Moxa	MGate MB3270 Series	Affected: 1.0 cpe:2.3:a:moxa:mgate_mb3270_series:1.0:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86326",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T10:37:09.559538Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T10:39:59.785Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MGate MB3170 Series",
          "vendor": "Moxa",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MGate MB3270 Series",
          "vendor": "Moxa",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:moxa:mgate_mb3170_series:1.0:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:moxa:mgate_mb3270_series:1.0:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper verification of cryptographic signature vulnerability exists in protocol gateways\u0026nbsp;because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provide a specially crafted or modified firmware image, causing it to be installed on the device. Successful exploitation could allow the attacker to execute unauthorized code, compromise the integrity and availability of the device, and persist malicious modifications across subsequent firmware updates."
            }
          ],
          "value": "An improper verification of cryptographic signature vulnerability exists in protocol gateways\u00a0because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provide a specially crafted or modified firmware image, causing it to be installed on the device. Successful exploitation could allow the attacker to execute unauthorized code, compromise the integrity and availability of the device, and persist malicious modifications across subsequent firmware updates."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-475",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-475: Signature Spoofing by Improper Validation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T10:21:56.863Z",
        "orgId": "2e0a0ee2-d866-482a-9f5e-ac03d156dbaa",
        "shortName": "Moxa"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269540-cve-2026-86325,-cve-2026-86326-two-vulnerabilities-in-protocol-gateways"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan\u003eUsers are advised to follow the applicable Security Hardening Guide for the MGate MB3000 or MGate 5000 Series when obtaining and updating firmware. The guides provide recommendations for securely obtaining firmware from official Moxa sources and performing firmware updates. Users should follow the applicable guidance to ensure that the correct and trusted firmware is obtained and that firmware updates are performed securely. For detailed mitigation guidance, please refer to the following Security Hardening Guides:\u003c/span\u003e\u003cul\u003e\u003cli\u003eThe Security Hardening Guide for the MGate 5000 Series\u003c/li\u003e\u003cli\u003eThe Security Hardening Guide for the MGate MB3000 Series\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "Users are advised to follow the applicable Security Hardening Guide for the MGate MB3000 or MGate 5000 Series when obtaining and updating firmware. The guides provide recommendations for securely obtaining firmware from official Moxa sources and performing firmware updates. Users should follow the applicable guidance to ensure that the correct and trusted firmware is obtained and that firmware updates are performed securely. For detailed mitigation guidance, please refer to the following Security Hardening Guides:  *  The Security Hardening Guide for the MGate 5000 Series\n  *  The Security Hardening Guide for the MGate MB3000 Series"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2e0a0ee2-d866-482a-9f5e-ac03d156dbaa",
    "assignerShortName": "Moxa",
    "cveId": "CVE-2026-86326",
    "datePublished": "2026-10-02T10:21:56.863Z",
    "dateReserved": "2026-09-07T06:34:04.814Z",
    "dateUpdated": "2026-10-02T10:39:59.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CERTFR-2026-AVI-1250

Solutions

CVE-2026-86325 (GCVE-0-2026-86325)

CVE-2026-86326 (GCVE-0-2026-86326)

Tags

Sightings

Nomenclature

Related by attack behaviour