# CVE-2026-15579: Moxa Ethernet Switch buffer overflow in Web login

Source: https://junglewise.ai/threats/cve-2026-15579-moxa-ethernet-switch-buffer-overflow-in-web-login  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-15579 · Severity: info · CVSS 8.8 · Published 2026-09-18

Moxa Ethernet switches used in industrial networks contain a buffer overflow vulnerability in their Web login interface. An attacker can send a specially crafted login request with an excessively long username to crash the authentication process, causing the switch to become unavailable and disrupting network operations.

Vendors: [Moxa](https://junglewise.ai/threats/vendors/moxa).

## Quick answers

**Is CVE-2026-15579 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15579 being exploited in the wild.

**How severe is CVE-2026-15579?** Informational severity, with a CVSS score of 8.8, published 18 September 2026.

**Which products and versions are affected?** Moxa TN-4500B Series Firmware v2.0 and earlier.

**Is there a fix for CVE-2026-15579?** A patch was published on 2026-09-18: Firmware v2.1 or later available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15579 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-15579?** Check whether you run Moxa TN-4500B Series at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability (CWE-787) exists in Moxa Ethernet switches due to improper validation of the username field length during Web login processing. The vulnerability can be triggered by submitting an overly long username string, which causes a buffer overflow in the authentication handler. An unauthenticated remote attacker can exploit this over the network without requiring any user interaction. The vulnerability results in a crash of the authentication process, causing a Denial of Service (DoS) condition. Moxa has released firmware v2.1 or later to address this issue.

## Affected products

- Moxa TN-4500B Series Firmware v2.0 and earlier

## Timeline

- 2026-09-18: disclosed
- 2026-09-18: patched: Firmware v2.1 or later available

## References

- [https://www.moxa.com/en/support/product-support/security-advisory/mpsa-252620-cve-2026-15579-out-of-bounds-write-vulnerability-in-ethernet-switch](https://www.moxa.com/en/support/product-support/security-advisory/mpsa-252620-cve-2026-15579-out-of-bounds-write-vulnerability-in-ethernet-switch)