CVE-2026-111459

Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client)

State: Published
Severity: 7.6 High
Published: Oct 27, 2026
Updated: Oct 27, 2026
Reserved: Oct 16, 2026

Description

An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle attack, potentially compromising the confidentiality and integrity of communications.

Scores

CVSS	Score	Vector	Source
4.0	7.6 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	Moxa

Weaknesses

CWE-295 Improper Certificate Validation

Affected Products

Product	Versions
Moxa Remote Connect Suite (MRC Client)Moxa	1.0.0 through 4.2.0Affected 4.2.2Not affected

References

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269510-cve-2026-111459-cve-2026-111460-cve-2026-111461-vulnerabilities-in-moxa-remote-connect-suite-mrc-clientvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.