Moxa MGate protocol gateways: Stack-based buffer overflow in account management
Summary
Moxa MGate MB3170 and MB3270 protocol gateways contain a stack-based buffer overflow in the account management function of the web interface. An attacker with a valid read-only account can send an overlong account name, which may allow reading sensitive data including credentials, modifying memory and disrupting the device. Moxa rates the vulnerability as critical (CVSS 4.0 base score 9.4); no exploitation is known.
Affected
- MGate MB3170 Series: 1.0 to 4.7
- MGate MB3270 Series: 1.0 to 4.7
- Other MGate models listed in the advisory (MB3180, MB3280, MB3480, MB3660, 5217) are also affected up to the versions shown in the advisory; verify on the Moxa advisory page.
Fixed in
- MGate MB3170 and MB3270: v4.7.1
- MGate MB3180: v2.7.1
- MGate MB3280: v4.6.3
- MGate MB3480: v4.5.1
- MGate MB3660: v3.4.5
- MGate 5217: v1.5.5
- Firmware is available through Moxa Technical Support.
Workaround
- The advisory gives no workaround for this CVE.
- Restrict access to the web management interface to trusted networks.
- Enable HTTPS and disable the HTTP console under Console Settings (general hardening guidance).
- Limit the number of accounts on the device.
Exploitation
- CISA SSVC: exploitation none, automatable no.
- Not listed in the CISA KEV catalog.
- No public proof-of-concept code found.
- No reports of in-the-wild exploitation found; this status is provisional.
Our recommendation
- Check whether MGate devices are in use and identify their firmware versions.
- Request the fixed firmware from Moxa Technical Support and update affected devices.
- Until patched, restrict management interface access and review read-only accounts.
- Verify the affected versions and fixes on the Moxa advisory page, and check the status of CVE-2026-86326 in the same advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Moxa advisory MPSA-269540 www.moxa.com
- CVE record (CNA) vulners.com
- OpenCVE record app.opencve.io
- Secondary summary (SecurityOnline) securityonline.info
- TheHackerWire entry www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:14.
Original description (NVD)
A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account management requests. An attacker authenticated as a read-only user to the web management interface could supply a specially crafted account name that exceeds the size of the internal stack buffer, resulting in corruption of program execution flow. Successful exploitation could allow an attacker to read sensitive information from device memory, including credentials, modify arbitrary memory contents, and disrupt device availability.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.