CVE-2026-3867
Last modified
CVE-2026-3867 is a medium-severity vulnerability rated 6/10 on the CVSS scale. An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may access a configuration file containing the hashed password of the administrative account. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may access a configuration file containing the hashed password of the administrative account. Successful exploitation of this vulnerability could allow an attacker to obtain sensitive information. Exploitation is only possible under a specific condition — when the configuration file has been exported. This vulnerability does not impact the integrity or availability of the affected product, and no confidentiality, integrity, or availability impact to the subsequent system has been identified.
Metrics
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Moxa | EDR-8010 Series | >= 1.0, <= 3.23 |
| Moxa | EDR-G9010 Series | >= 1.0, <= 3.23.1; 3.24 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-3867?
How severe is CVE-2026-3867?
How do I fix CVE-2026-3867?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-38639An issue in the parse_month function (/time/strptime.rs) of …7.5
- CVE-2026-3864A vulnerability was discovered in the Kubernetes CSI Driver …6.5
- CVE-2026-38640A reachable unwrap in the __assert_fail function (/assert/mo…7.5
- CVE-2026-38641An issue in the DSO::mmap_and_copy function of relibc commit…7.5
- CVE-2026-38651Authentication Bypass vulnerability exists in Netmaker versi…8.2
- CVE-2026-38669wCMS v.1.4 is vulnerable to Cross Site Scripting (XSS) when …6.1
- CVE-2026-3868An improper handling of the length parameter inconsistency v…8.7
- CVE-2026-3870A buffer overflow vulnerability in the UPnP AddPortMapping()…6.5
- CVE-2026-38702A command injection vulnerability exists in the Admin Access…9.8
- CVE-2026-38703A command injection vulnerability exists in the ZeroTier VPN…9.8
- CVE-2026-38704A command injection vulnerability exists in the WireGuard VP…9.8
- CVE-2026-38707A command injection vulnerability exists in the IPSec VPN fe…9.8
Are you affected by CVE-2026-3867?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST