CVE-2026-111459: Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client)
An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle attack, potentially compromising the confidentiality and integrity of communications.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
MRC Client users whose client-to-server communications can be observed or modified by an attacker are exposed. The described attack requires on-path access between the client and its server.
What does an attacker need to exploit the vulnerability?
The attacker must be unauthenticated but able to position themselves on the communication path between the MRC Client and its server. They can then impersonate a trusted server and perform a man-in-the-middle attack under the affected conditions.
What could an attacker gain through successful exploitation?
A successful man-in-the-middle attack could compromise the confidentiality and integrity of communications between the MRC Client and its server.