{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-111459","assignerOrgId":"2e0a0ee2-d866-482a-9f5e-ac03d156dbaa","state":"PUBLISHED","assignerShortName":"Moxa","dateReserved":"2026-10-16T05:36:36.354Z","datePublished":"2026-10-27T07:08:17.598Z","dateUpdated":"2026-10-27T07:08:17.598Z"},"containers":{"cna":{"providerMetadata":{"orgId":"2e0a0ee2-d866-482a-9f5e-ac03d156dbaa","shortName":"Moxa","dateUpdated":"2026-10-27T07:08:17.598Z"},"title":"Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client)","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-295","description":"CWE-295: Improper Certificate Validation","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-94","descriptions":[{"lang":"en","value":"CAPEC-94: Adversary in the Middle (AiTM)"}]}],"affected":[{"vendor":"Moxa","product":"Moxa Remote Connect Suite (MRC Client)","versions":[{"status":"affected","version":"1.0.0","lessThanOrEqual":"4.2.0","versionType":"custom"},{"status":"unaffected","version":"4.2.2","versionType":"custom"}],"defaultStatus":"unaffected"}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moxa:moxa_remote_connect_suite_mrc_client_:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndIncluding":"4.2.0"},{"vulnerable":false,"criteria":"cpe:2.3:a:moxa:moxa_remote_connect_suite_mrc_client_:4.2.2:*:*:*:*:*:*:*"}]}]}],"descriptions":[{"lang":"en","value":"An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle attack, potentially compromising the confidentiality and integrity of communications.","supportingMedia":[{"type":"text/html","base64":false,"value":"An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle attack, potentially compromising the confidentiality and integrity of communications."}]}],"references":[{"url":"https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269510-cve-2026-111459-cve-2026-111460-cve-2026-111461-vulnerabilities-in-moxa-remote-connect-suite-mrc-client","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":7.6,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}],"solutions":[{"lang":"en","value":"Please refer Moxa's security advisory: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269510-cve-2026-111459-cve-2026-111460-cve-2026-111461-vulnerabilities-in-moxa-remote-connect-suite-mrc-client","supportingMedia":[{"type":"text/html","base64":false,"value":"Please refer Moxa's security advisory: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269510-cve-2026-111459-cve-2026-111460-cve-2026-111461-vulnerabilities-in-moxa-remote-connect-suite-mrc-client "}]}],"credits":[{"lang":"en","value":"Abhinav Agarwal","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}}}}