# Moxa Patches Flaws in NPort and Remote Connect

Published: 2026-10-27 · Severity: routine · Sectors: Infrastructure, Manufacturing, Telecommunications
Canonical: https://vorant.io/reports/fd9e95e4-e10d-5a3d-a582-92b4ca64f4c9/moxa-patches-flaws-in-nport-and-remote-connect
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advisory details multiple vulnerabilities in Moxa NPort wireless device servers and Remote Connect Suite enabling code execution, DoS, and data exposure.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1393

## What to check

- Applies to: The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR issued an advisory covering multiple vulnerabilities in Moxa industrial networking products. Affected systems include the NPort W2150A-W4/W2250A-W4 Series wireless device servers (versions prior to v1.5.9) and Moxa Remote Connect Suite (versions prior to v4.2.2). A stack buffer overflow vulnerability (CVE-2026-111548) affects the wireless device servers, while three vulnerabilities (CVE-2026-111459, CVE-2026-111460, CVE-2026-111461) affect the Remote Connect Suite MRC Client. Successful exploitation could allow an attacker to achieve arbitrary code execution, remote denial of service, and compromise of data confidentiality, as well as potentially bypass security policies or affect data integrity.

No in-the-wild exploitation is mentioned in this advisory. Moxa requires affected customers to contact technical support directly to obtain patches for the NPort and Remote Connect Suite products, rather than providing a direct download. The OnCell G3150A-LTE Series product is noted as end-of-life and will not receive fixes, meaning organizations still running it should plan migration to supported hardware.

Defenders operating Moxa NPort W2150A-W4/W2250A-W4 series wireless device servers or Remote Connect Suite should verify installed versions against the fixed releases (v1.5.9 and v4.2.2 respectively), contact Moxa support for patches, and prioritize remediation given the operational technology context in which these devices are typically deployed (industrial/remote access connectivity).

## Mentioned in this report

- Vulnerabilities: CVE-2026-111459, CVE-2026-111460, CVE-2026-111461, CVE-2026-111548

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1393

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/fd9e95e4-e10d-5a3d-a582-92b4ca64f4c9/moxa-patches-flaws-in-nport-and-remote-connect.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup