Vendors and CVEs › Vendors › Moxa
Moxa: industrial cyber security news and vulnerabilities
4 stories in Industrial Cyber Brief name Moxa, 1 on CISA’s list of known exploited flaws, from Monday 19 October 2026 to Tuesday 10 November 2026. Newest first; each links the full story with who is affected and what to do.
The stories
Critical Known exploited
Moxa responds to OpenSSH password bypass on Linux without PAM
A flaw in the OpenSSH server (sshd) before 10.6p2 lets some accounts be opened with any password of 256 to 1024 characters. It applies on Linux using musl libc without PAM, such as Alpine Linux.
Low
Moxa remote-access client and cellular gateway have three flaws
Moxa has published an advisory on three vulnerabilities (CVE-2026-111459, CVE-2026-111460, CVE-2026-111461) in Moxa Remote Connect Suite client and the OnCell G3150A-LTE Series. No severity rating is given.
High
Moxa AIG-302 ThingsPro Edge flaws could expose sensitive data
Moxa AIG-302 ThingsPro Edge firmware up to 1.4.0 has two flaws: missing authorisation and a hard-coded cryptographic key. One lets a privileged attacker with adjacent network access read sensitive data, including keys.
Medium
Moxa AIG-302 Series has two flaws in versions up to v1.4.1
Moxa is affected by vulnerabilities in its AIG-302 Series, versions up to and including v1.4.1. The Canadian Centre for Cyber Security lists CVE-2026-109812 and CVE-2026-109813 and links to Moxa's advisory.