CVE-2026-3868
Buffer Overflow in Moxa Secure Router HTTPS Causes DoS
Publication date: 2026-04-27
Last updated on: 2026-04-27
Assigner: Moxa Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| moxa | secure_router | 3.22 |
| moxa | secure_router | 3.23 |
| moxa | secure_router | to 3.24 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-130 | The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The CVE-2026-3868 vulnerability affects Moxa’s Secure Router and involves improper handling of length parameter inconsistency in the HTTPS management interface.
Due to inadequate validation of length parameters, an unauthenticated remote attacker can send specially crafted requests that trigger a buffer overflow condition.
This overflow causes the web service to become unresponsive, resulting in a denial-of-service (DoS) condition that requires a device reboot to restore normal operation.
While this vulnerability severely impacts device availability, it does not affect the confidentiality or integrity of the product or any subsequent systems.
How can this vulnerability impact me? :
This vulnerability can severely impact the availability of the affected Moxa Secure Router device by causing the HTTPS management web service to become unresponsive.
An unauthenticated remote attacker can exploit this by sending specially crafted requests that trigger a buffer overflow, leading to a denial-of-service (DoS) condition.
Successful exploitation requires a device reboot to restore normal operation, which can disrupt network management and operations relying on the device.
However, there is no identified impact on the confidentiality or integrity of the device or connected systems.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring network traffic for anomalies related to specially crafted HTTPS requests targeting the management interface of Moxa Secure Routers.
While specific commands are not provided, general detection methods include enabling logging and audit trails on the device to capture unusual or malformed HTTPS requests, and using network monitoring tools to identify suspicious traffic patterns that could trigger the buffer overflow condition.
Additionally, conducting regular security assessments and reviewing firewall or ACL logs for unauthorized access attempts to the HTTPS management interface can help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the firmware update to version 3.24 or later, which addresses the vulnerability.
- Restrict network access to the HTTPS management interface using firewalls or access control lists (ACLs).
- Segregate operational networks to minimize exposure.
- Disable unused services and ports on the device.
- Implement multi-factor authentication and role-based access control for management access.
- Secure remote access using encrypted protocols.
- Monitor network traffic for anomalies and enable logging and audit trails.
- Conduct regular security assessments to identify and address potential risks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability causes a denial-of-service condition by making the web service unresponsive, impacting the availability of the affected device.
There is no identified impact on confidentiality or integrity of the product or any subsequent systems.
Since the vulnerability affects availability but not confidentiality or integrity, its direct impact on compliance with standards like GDPR or HIPAA—which emphasize protection of personal data confidentiality and integrity—is limited.
However, availability is also a component of information security standards, so organizations relying on affected devices should consider the risk of service disruption in their compliance and risk management processes.