# CVE-2026-3867: CVE-2026-3867

Status: published. Published: 2026-04-27. Updated: 2026-11-02.

An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may access a configuration file containing the hashed password of the administrative account. Successful exploitation of this vulnerability could allow an attacker to obtain sensitive information. Exploitation is only possible under a specific condition — when the configuration file has been exported. This vulnerability does not impact the integrity or availability of the affected product, and no confidentiality, integrity, or availability impact to the subsequent system has been identified.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Moxa / EDR-8010 Series: ≥ 1.0; ≤ 3.23 (affected, custom); 3.24 (unaffected, custom). Source: CNA: Moxa
- Moxa / EDR-G9010 Series: ≥ 1.0; ≤ 3.23.1 (affected, custom); 3.24 (affected, custom). Source: CNA: Moxa

## Severity and prioritization

- CVSS 4.0: 6 (medium); CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N; source: CNA: Moxa

- CISA KEV: No listing in collected sources

- EPSS: 0.24% as of 2026-11-01; percentile 15.19%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-282

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.moxa.com/en/support/product-support/security-advisory/mpsa-261521-cve-2026-3867-cve-2026-3868-improper-ownership-management-and-improper-handling-of-length-parameter-incons (CNA: Moxa; vendor-advisory)

## Provenance

- CNA: Moxa: https://www.cve.org/CVERecord?id=CVE-2026-3867; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-3867; retrieved 2026-11-02; source updated Not reported

Revision: 62307f4b585f920a02087a3ec477e99936bb9e3585c83ee23ca8fc6b6b2cf362

Canonical: https://y2.dev/cve/CVE-2026-3867