Moxa MGate Stack Buffer Overflow and Firmware Signature Verification Vulnerabilities (CVE-2026-86325/86326)

Vulnerability Overview CVE-2026-86325: A stack buffer overflow vulnerability exists in the account management interface of the protocol gateway. This vulnerability is caused by insufficient length validation of the parameter when processing account management requests. An attacker can cause program execution flow corruption by providing a specially crafted account name that exceeds the size of the internal stack buffer. Upon successful exploitation, the attacker can read sensitive information from device memory (including credentials), modify arbitrary memory contents, and compromise device availability. CVE-2026-86326: An incorrect encryption signature verification vulnerability exists in the protocol gateway. The device fails to properly verify the cryptographic authenticity of the firmware image before installation. An attacker with privileged access to the firmware update interface can provide a specially crafted or modified firmware image, leading to the execution of unauthorized code on the device. Upon successful exploitation, the attacker can execute unauthorized code, compromise device integrity and availability, and persist malicious modifications in subsequent firmware updates. Affected Products CVE-2026-86325: - Vulnerability Type: Stack buffer overflow - Impact: CAPEC-24: Filtering Failure via Buffer Overflow - CVSS Score: 9.4 (Critical) - Affected Products: Specific firmware versions of the MGate 3000 series and MGate 5217 series CVE-2026-86326: - Vulnerability Type: Incorrect validation of cryptographic signatures - Impact: CAPEC-475: Signature Spoofing via Incorrect Validation - CVSS Score: 8.6 (High) - Affected Products: All firmware versions of the MGate 3000 series and MGate 5000 series Remediation CVE-2026-86325: - Solution: Contact Moxa Technical Support for a security patch. - Mitigation: For users unable to update firmware, it is recommended to follow general security best practices to enhance the security context. CVE-2026-86326: - Solution: See mitigation measures. - Mitigation: Users should follow the security hardening guidelines for the MGate MB3000 or MGate 5000 series, ensuring firmware is obtained from official Moxa sources and that firmware updates are executed securely during acquisition and installation. Related Product Information MGate 5101-PBM-MN Series MGate 5102-PBM-PN Series MGate 5103 Series MGate 5105-MB-EIP Series MGate 5109 Series MGate 5111 Series MGate 5114 Series MGate 5118 Series MGate 5119 Series MGate 5216 Series MGate 5217 Series MGate EIP3170/EIP3270 Series MGate MB3170/MB3270 Series MGate MB3180/MB3280/MB3480 Series MGate MB3660 Series MGate WS106/W5208 Series General Security Recommendations Follow general security recommendations to enhance the security context. Revision History Version 1.0: Initial release, published on October 2, 2026. Related Announcements Protocol Gateway Vulnerabilities in MGate MB3000 Series, MGate 5100 Series, and MGate W5000 Series Moxa's Response to Key Reinstallation Attacks (KRACKs) Vulnerabilities Summary This security advisory covers two vulnerabilities in protocol gateways: a stack buffer overflow and incorrect encryption signature verification. The affected products include specific firmware versions of the MGate 3000 series, MGate 5000 series, and MGate 5217 series. Moxa has developed appropriate solutions, and users should apply them immediately to reduce security risks. For users unable to perform firmware updates, it is recommended to follow general security recommendations and mitigation measures.

Goal Reached Thanks to every supporter — we hit 100%!

Moxa MGate Stack Buffer Overflow and Firmware Signature Verification Vulnerabilities (CVE-2026-86325/86326)