CVE-2026-4483

An exposed IOCTL with an insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x86 computers. The affected utility, MxGeneralIo, exposes IOCTL methods that permit direct read and write access to MSR and system memory. A local attacker with high privileges could abuse these interfaces to perform unauthorized operations. Successful exploitation may result in privilege escalation on Windows 7 systems or cause a system crash (BSoD) on Windows 10 and 11 systems, leading to a denial-of-service condition. The vulnerability could slightly affect the confidentiality and integrity of the device, but availability might be heavily impacted. No impact to the subsequent system has been identified.

CVSS

No CVSS.

References

Link	Resource
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-254811-cve-2026-4483-exposed-ioctl-with-insufficient-access-control-vulnerability-in-the-utility-for-x86-computers

Configurations

No configuration.

History

No history.

Information

Published : 2026-04-08 08:16

Updated : 2026-07-24 20:10

NVD link : CVE-2026-4483

Mitre link : CVE-2026-4483

CVE.ORG link : CVE-2026-4483

JSON object : View

Products Affected

No product.

CWE

CWE-782

Exposed IOCTL with Insufficient Access Control

{"id": "CVE-2026-4483", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4483", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T13:53:18.890748Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "psirt@moxa.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "psirt@moxa.com", "affectedData": [{"vendor": "Moxa", "product": "MxGeneralIo", "versions": [{"status": "affected", "version": "1.0", "lessThan": "1.4.0", "versionType": "custom"}], "platforms": ["Windows 7 x86"], "defaultStatus": "unaffected"}, {"vendor": "Moxa", "product": "MxGeneralIo", "versions": [{"status": "affected", "version": "1.0", "lessThan": "1.5.0", "versionType": "custom"}], "platforms": ["Windows 10", "Windows 11"], "defaultStatus": "unaffected"}, {"vendor": "Moxa", "product": "MxGeneralIo", "versions": [{"status": "affected", "version": "1.0", "lessThan": "1.4.0", "versionType": "custom"}], "platforms": ["Windows 7 x64"], "defaultStatus": "unaffected"}]}], "published": "2026-04-08T08:16:24.007", "references": [{"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-254811-cve-2026-4483-exposed-ioctl-with-insufficient-access-control-vulnerability-in-the-utility-for-x86-computers", "source": "psirt@moxa.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@moxa.com", "description": [{"lang": "en", "value": "CWE-782"}]}], "descriptions": [{"lang": "en", "value": "An exposed IOCTL with an\u00a0 insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa\u2019s industrial x86 computers.\u00a0The affected utility, MxGeneralIo, exposes IOCTL methods that permit direct read and write access to MSR and system memory.\u00a0A local attacker with high privileges could abuse these interfaces to perform unauthorized operations.\u00a0Successful exploitation may result in privilege escalation on Windows 7 systems or cause a system crash (BSoD) on Windows 10 and 11 systems, leading to a denial-of-service condition.\u00a0The vulnerability could slightly affect the confidentiality and integrity of the device, but availability might be heavily impacted.\u00a0No impact to the subsequent system has been identified."}, {"lang": "es", "value": "Un IOCTL expuesto con una vulnerabilidad de control de acceso insuficiente ha sido identificado en la utilidad, MxGeneralIo, para los ordenadores industriales x86 de Moxa. La utilidad afectada, MxGeneralIo, expone m\u00e9todos IOCTL que permiten acceso directo de lectura y escritura a MSR y a la memoria del sistema. Un atacante local con privilegios elevados podr\u00eda abusar de estas interfaces para realizar operaciones no autorizadas. La explotaci\u00f3n exitosa puede resultar en escalada de privilegios en sistemas Windows 7 o causar un fallo del sistema (BSoD) en sistemas Windows 10 y 11, lo que lleva a una condici\u00f3n de denegaci\u00f3n de servicio. La vulnerabilidad podr\u00eda afectar ligeramente la confidencialidad e integridad del dispositivo, pero la disponibilidad podr\u00eda verse gravemente impactada. Ning\u00fan impacto en el sistema subsiguiente ha sido identificado."}], "lastModified": "2026-07-24T20:10:00.147", "sourceIdentifier": "psirt@moxa.com"}