TI-2026-03893 Aliases CVE-2026-4483 GHSA-9fq9-vh4p-342c

An exposed IOCTL with an insufficient access control vulnerability has been identified in…

LOW 37CWE-782Published 2026-04-08 · Updated 2026-04-08

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · Low · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An exposed IOCTL with an insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x86 computers. The affected utility, MxGeneralIo, exposes IOCTL methods that permit direct read and write access to MSR and system memory. A local attacker with high privileges could abuse these interfaces to perform unauthorized operations. Successful exploitation may result in privilege escalation on Windows 7 systems or cause a system crash (BSoD) on Windows 10 and 11 systems, leading to a denial-of-service condition. The vulnerability could slightly affect the confidentiality and integrity of the device, but availability might be heavily impacted. No impact to the subsequent system has been identified.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00311 24th percentileScored 2026-11-07

Fix Fixed MxGeneralIo (Moxa): 1.4.0, 1.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Moxa	MxGeneralIo	1.0 to before 1.4.0	1.4.0	Patch available	CNA
Moxa	MxGeneralIo	1.0 to before 1.5.0	1.5.0	Patch available	CNA
Moxa	MxGeneralIo	1.0 to before 1.4.0	1.4.0	Patch available	CNA

MxGeneralIo VendorMoxa Affected 1.0 to before 1.4.0 Fixed in 1.4.0 Patch available CNA
MxGeneralIo VendorMoxa Affected 1.0 to before 1.5.0 Fixed in 1.5.0 Patch available CNA
MxGeneralIo VendorMoxa Affected 1.0 to before 1.4.0 Fixed in 1.4.0 Patch available CNA

Remediation

Fix · CNA MxGeneralIo (Moxa) Fixed in 1.4.0
Fix · CNA MxGeneralIo (Moxa) Fixed in 1.5.0
Fix · CNA MxGeneralIo (Moxa) Fixed in 1.4.0

Timeline

2026-10-02 Threatist record created from CVE-2026-4483
2026-10-03 Alias added: GHSA-9fq9-vh4p-342c

References

Advisory 1

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-254811-cve-2026-4483-exposed-ioctl-with-insufficient-access-control-vulnerability-in-the-utility-for-x86-computers

TI-2021-17455 Hard-coded credentials in Moxa MXView Series CVSS 3.1CRITICAL 9.8
TI-2010-04465 Stack-based buffer overflow in a certain ActiveX control in MediaDBPlayback.DLL 2.2.0.5… CVSS 2.0HIGH 10.0
TI-2022-19087 A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008… CVSS 3.1HIGH 7.5
TI-2016-07634 Missing brute-force protection in Moxa NPort CVSS 3.1CRITICAL 9.8
TI-2021-17457 Cleartext transmission of sensitive information in Moxa MXView Series CVSS 3.1HIGH 7.5
TI-2022-19326 Information disclosure in Moxa SDS-3008 Series Industrial Ethernet Switch CVSS 3.1MEDIUM 5.3

See all 328 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences