CVE-2026-3867 PUBLISHED

Assigner: Moxa
Reserved: 10.03.2026 Published: 27.04.2026 Updated: 27.04.2026

An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may access a configuration file containing the hashed password of the administrative account. Successful exploitation of this vulnerability could allow an attacker to obtain sensitive information. Exploitation is only possible under a specific condition — when the configuration file has been exported. This vulnerability does not impact the integrity or availability of the affected product, and no confidentiality, integrity, or availability impact to the subsequent system has been identified.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6

Product Status

Vendor Moxa
Product EDR-8010 Series
Versions Default: unaffected
  • affected from 1.0 to 3.23 (incl.)
  • Version 3.24 is unaffected
Vendor Moxa
Product EDR-G9010 Series
Versions Default: unaffected
  • affected from 1.0 to 3.23.1 (incl.)
  • Version 3.24 is affected

References

Problem Types

  • CWE-282: Improper Ownership Management CWE

Impacts

  • CAPEC-122: Privilege Abuse