Moxa Patches Flaws in NPort and Remote Connect
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT-FR advisory details multiple vulnerabilities in Moxa NPort wireless device servers and Remote Connect Suite enabling code execution, DoS, and data exposure.
CERT-FR issued an advisory covering multiple vulnerabilities in Moxa industrial networking products. Affected systems include the NPort W2150A-W4/W2250A-W4 Series wireless device servers (versions prior to v1.5.9) and Moxa Remote Connect Suite (versions prior to v4.2.2). A stack buffer overflow vulnerability (CVE-2026-111548) affects the wireless device servers, while three vulnerabilities (CVE-2026-111459, CVE-2026-111460, CVE-2026-111461) affect the Remote Connect Suite MRC Client. Successful exploitation could allow an attacker to achieve arbitrary code execution, remote denial of service, and compromise of data confidentiality, as well as potentially bypass security policies or affect data integrity.
No in-the-wild exploitation is mentioned in this advisory. Moxa requires affected customers to contact technical support directly to obtain patches for the NPort and Remote Connect Suite products, rather than providing a direct download. The OnCell G3150A-LTE Series product is noted as end-of-life and will not receive fixes, meaning organizations still running it should plan migration to supported hardware.
Defenders operating Moxa NPort W2150A-W4/W2250A-W4 series wireless device servers or Remote Connect Suite should verify installed versions against the fixed releases (v1.5.9 and v4.2.2 respectively), contact Moxa support for patches, and prioritize remediation given the operational technology context in which these devices are typically deployed (industrial/remote access connectivity).
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1393
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,359 reports from 144 sources, 627 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs