{"id":"CVE-2026-111548","kind":"vulnerability","aliases":["CVE-2026-111548"],"related":[],"title":"Moxa wireless device servers: web interface overflow lets attackers crash management service","description":"A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers. An authenticated remote attacker with low privileges could exploit insufficient bounds checking of user-supplied input, causing the web management service to become unresponsive. Restoring the service requires power cycling the affected device, while other device functions remain operational.","summary":"A stack-based buffer overflow in the web management interface of affected Moxa wireless device servers lets an authenticated remote attacker with low privileges make the web management service unresponsive. Recovery requires power cycling the device, while other device functions keep running.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["industrial-network","infrastructure","moxa","wireless-device-server"],"not_affected_if":["no-moxa-device"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T11:17:27+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","triaged_at":"2026-10-27T11:32:16+00:00","updated_at":"2026-10-27T11:32:16+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T11:32:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Moxa wireless device servers: web interface overflow lets attackers crash management service","impact":"low","summary":"A stack-based buffer overflow in the web management interface of affected Moxa wireless device servers lets an authenticated remote attacker with low privileges make the web management service unresponsive. Recovery requires power cycling the device, while other device functions keep running.","category":"infrastructure","nicknames":[],"who_cares":["moxa","wireless-device-server","industrial-network"],"confidence":0.6,"needs_auth":"yes","worst_case":"Web management service becomes unresponsive until the device is power cycled","analyst_note":"Find the affected Moxa product models and firmware versions and the vendor advisory with the fixed version, since the NVD entry alone does not list them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-moxa-device"],"who_is_affected":"Organizations running affected Moxa wireless device servers with the web management interface reachable by low-privilege users. The sources do not list affected firmware versions or whether the web interface is exposed by default. Teams without Moxa wireless device servers can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000556,"input_tokens":3331,"output_tokens":446,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111548':15A,18A '-2026':14A,17A 'affect':40B,85C,122C 'attack':9A,49B,93C 'authent':47B,91C 'base':31B,74C 'becom':113C 'bound':100C 'buffer':32B,75C 'caus':107C 'check':101C 'could':97C 'crash':10A 'cve':13A,16A 'cycl':62B,120C 'devic':3A,26B,43B,64B,67B,88C,123C,126C 'exist':78C 'exploit':98C 'function':68B,127C 'industri':20B 'industrial-network':19B 'infrastructur':22B 'input':106C 'insuffici':99C 'interfac':6A,38B,83C 'keep':69B 'let':8A,45B 'low':51B,95C 'make':53B 'manag':11A,37B,56B,82C,110C 'moxa':1A,23B,41B,86C 'network':21B 'oper':129C 'overflow':7A,33B,76C 'power':61B,119C 'privileg':52B,96C 'recoveri':59B 'remain':128C 'remot':48B,92C 'requir':60B,118C 'restor':115C 'run':70B 'server':4A,27B,44B,89C 'servic':12A,57B,111C,117C 'stack':30B,73C 'stack-bas':29B,72C 'suppli':105C 'unrespons':58B,114C 'user':104C 'user-suppli':103C 'vulner':77C 'web':5A,36B,55B,81C,109C 'wireless':2A,25B,42B,87C 'wireless-device-serv':24B","nicknames":[],"mitigations":[],"who_affected":"Organizations running affected Moxa wireless device servers with the web management interface reachable by low-privilege users. The sources do not list affected firmware versions or whether the web interface is exposed by default. Teams without Moxa wireless device servers can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@moxa.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111548","severity":null,"published_at":"2026-10-27T11:17:27+00:00","modified_at":"2026-10-27T11:17:27+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","fetched_at":"2026-10-27T11:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}