Recommended Free Tools
Moxa’s October 2026 security advisory identifies two serious vulnerabilities affecting specific MGate 3000 and MGate 5000 models and firmware versions. The fixes and prerequisites differ by vulnerability, so first identify your exact model and firmware, then follow the matching instructions in Moxa’s current advisory. Do not assume every MGate is affected—or that a single firmware update addresses both issues.
What are the Moxa MGate vulnerabilities?
Moxa lists two separate flaws: a stack-based buffer overflow, CVE-2026-86325, and improper verification of a cryptographic signature, CVE-2026-86326. In its 2026 advisory, Moxa assigns the first a CVSS 4.0 score of 9.4 (Critical) and the second a score of 8.6 (High). Those scores indicate assessed severity; they do not establish how likely exploitation is or whether attacks have occurred.
As an Amazon Associate I earn from qualifying purchases.
| CVE | Issue | Moxa CVSS 4.0 rating | Access conditions described by Moxa |
|---|---|---|---|
| CVE-2026-86325 | CWE-121 stack-based buffer overflow | 9.4 (Critical) | The advisory does not indicate unauthenticated remote exploitation; its vector includes low privileges. |
| CVE-2026-86326 | CWE-347 improper verification of a cryptographic signature | 8.6 (High) | The advisory does not indicate unauthenticated remote exploitation; exploitation requires high privileges and access to the firmware-update interface. |
The Canadian Centre for Cyber Security’s advisory AV26-995, dated 2026-10-02, also identifies MGate 3000 and MGate 5000 families and directs users to Moxa’s advisory. Neither notice supports the claim that anyone on the internet can exploit either flaw without credentials.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Which MGate models are affected?
Moxa’s advisory names affected models in both families, including MB3170, MB3270, MB3180, MB3280, MB3480, MB3660, 5217, EIP3170, EIP3270, 5216, W5108 and W5208, along with several 5100-series models. That list is not a substitute for checking the advisory: applicability depends on the specific CVE, model and firmware version, and the government summary does not reproduce Moxa’s full model-and-firmware table.
#1 Best Overall
- Supports Auto Device Routing for easy configuration
- Supports route by TCP port or IP address for flexible deployment
- Connects up to 32 Modbus TCP servers
- Connects up to 31 or 62 Modbus RTU/ASCII slaves
- Accessed by up to 32 Modbus TCP clients (retains 32 Modbus requests for each Master)
Check the product label and device management interface for the complete model identifier and installed firmware version. Compare both against the current Moxa advisory. A family name alone, such as “MGate 5000,” is not enough to determine whether a unit is affected or which remedy applies.
How to update or mitigate an affected MGate
- Inventory the device. Record its exact model and installed firmware version from the product label and management interface. Include the device’s location and the network path to its management and update interfaces.
- Match the model and CVE. In Moxa’s current security advisory, find the entries for your exact model and each vulnerability. Follow the listed fixed firmware level or mitigation for that specific combination; do not apply a fix listed for another model or assume one update covers both CVEs.
- Check patch availability. For CVE-2026-86325, Moxa lists fixed firmware levels for several product families. For some MB3000 and 5217 products, the advisory says to contact Moxa Technical Support for the security patch. For CVE-2026-86326, Moxa points users to the relevant MGate MB3000 or MGate 5000 Security Hardening Guide for secure firmware updating.
- Plan and validate the change. Follow Moxa’s model-specific update or mitigation instructions and your organization’s change-control process. Test configuration changes before deploying them in production, as Moxa’s MGate 5000 hardening guidance recommends.
- Confirm the result. After the change, verify the installed firmware against the advisory’s fixed level, check that the gateway and required protocol communications work as intended, and retain the device and change records.
Firmware levels and patch instructions are model-specific and can change. Use Moxa’s live advisory and applicable hardening guide as the source of truth before making a change; the Canadian government notice confirms the affected families but does not provide the full firmware table.
What can administrators do while arranging a fix?
Use network controls to reduce exposure while following the applicable patch or mitigation path. Moxa’s MGate 5000 hardening guide recommends placing devices behind a secure firewall and/or IDS/IPS, protecting physical access, checking Moxa’s support site for newer firmware, and considering features such as Accessible IP List and Secure Connection.
- Restrict network paths to the gateway, especially access to management and firmware-update interfaces, to the systems and administrators that need them.
- Place the gateway behind suitable firewall or IDS/IPS protections and limit unnecessary exposure to internal and external networks.
- Protect physical access to the device and use the relevant hardening-guide settings where appropriate.
- Test changes before production deployment so that security controls do not disrupt required industrial communications.
These are defense-in-depth measures, not substitutes for the model-specific patch or mitigation in Moxa’s advisory.
Rank #3
- Connects fieldbus data to cloud through generic MQTT
- Supports MQTT connection with built-in device SDKs to Azure/Alibaba Cloud
- Protocol conversion between Modbus and EtherNet/IP
- Supports EtherNet/IP Scanner/Adapter
- Supports Modbus RTU/ASCII/TCP master/client and slave/server
Do not confuse these CVEs with older MGate issues
Other Moxa and MGate vulnerability notices describe different flaws and affected firmware. Moxa’s 2022 advisory, revised 2025-08-05, covered a man-in-the-middle issue for specified MB-series firmware. A 2021 Moxa advisory covered a crafted-packet memory leak in MGate 5109 and 5101-PBM-MN. Separately, NVD’s record for CVE-2025-0193 describes stored cross-site scripting involving the Login Message function in MGate 5121, 5122 and 5123 firmware v1.0. These are not the October 2026 CVEs and have separate scopes and remediation guidance.
For an installed gateway, use the exact model and firmware to match it to the relevant advisory. Replacing a device or buying a new gateway does not fix vulnerable firmware on equipment that remains in service.
Quick Recap
Best Value
- Supports Auto Device Routing for easy configuration
- Supports route by TCP port or IP address for flexible deployment
- Converts between Modbus TCP and Modbus RTU/ASCII protocols
- 1 Ethernet port and 1, 2, or 4 RS-232/422/485 ports
- 16 simultaneous TCP masters with up to 32 simultaneous requests per master
Rank #4
- Seamlessly converts between Modbus TCP, Modbus RTU, and Modbus ASCII protocols. Allows Modbus TCP masters to communicate with Modbus RTU/ASCII slaves, and Modbus RTU/ASCII masters to communicate with Modbus TCP slaves/servers.
- 1 x software-selectable serial port (DB9 male connector for RS-232, and terminal block for RS-422/485).
- Supports RS-232, RS-422, and 2-wire/4-wire RS-485 standards
- Automatic Data Direction Control (ADDC) for RS-485 simplifies wiring and ensures reliable data transmission.
- Selectable 120-ohm termination and 1 kΩ/150 kΩ pull high/low resistors for RS-485. Wide baud rate support from 50 bps to 921.6 kbps.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
