Moxa MRC Client CVE-2026-111459

The attacker must hold an on-path (man-in-the-middle) position on the network between the MRC Client and its MRC server - this positional prerequisite is the AT:P attack requirement, not a generic 'network access' note. Given that position, no authentication is required (PR:N). The flaw is improper validation of the server's certificate (CWE-295), so exploitation hinges on the client accepting a server identity it should reject; the specific validation defect (e.g., unchecked chain, hostname, or trust anchor) is not detailed in the available sources. Limiting factors that reduce realistic risk: the mandatory on-path position, the passive user interaction indicated by UI:P, and the affected scope being MRC Client versions 1.0.0 through 4.2.0. Availability is not affected (VA:N) - impact is confined to confidentiality and integrity of the intercepted communications.

This is a moderate-priority issue whose signals are internally consistent and point away from mass exploitation. The CVSS 4.0 base score of 7.6 (High) is driven by high confidentiality AND integrity impact (VC:H/VI:H) against an unauthenticated attacker (PR:N), but it is materially constrained by two metrics: AT:P (a specific attack requirement - the attacker must already hold an on-path/man-in-the-middle position between the MRC Client and its server) and UI:P (passive user interaction is involved). These are not race-condition or heap-grooming qualifiers - the description states explicitly that exploitation requires 'on-path access to the communication,' which is what AT:P encodes here. EPSS is low at 0.17% (7th percentile), and there is no CISA KEV listing and no public exploit or PoC reference in the provided data, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_week,' indicating it warrants near-term patching but not emergency treatment. Net assessment: a genuine confidentiality/integrity risk for exposed or untrusted-network deployments of MRC Client, but the on-path prerequisite makes this better suited to targeted interception (e.g., hostile or shared networks, OT/remote-access links) than opportunistic mass attack. The network attack vector (AV:N) and the on-path requirement (AT:P) are consistent rather than conflicting - AV:N reflects that the vulnerable channel is network-based, while AT:P captures the positional prerequisite.

An attacker who can intercept traffic on the network path between a Moxa MRC Client and its server (for example on a shared or hostile Wi-Fi/OT segment, or via upstream routing control) presents a forged or untrusted server certificate that the client fails to validate properly (CWE-295). The client accepts the impersonated server, letting the attacker decrypt, read, and modify the supposedly protected communications. No public exploit code is identified at time of analysis, and the attacker must hold an on-path position and involve some passive user interaction, so this is a targeted rather than drive-by scenario.