An Over-Long Username Crashes Moxa's Rail-Rated Switch
MPSA-252620 describes an out-of-bounds write in the TN-4500B web login handler: no authentication needed, and the result is a dead management plane on a switch inside a train.
Moxa published advisory MPSA-252620 on 18 September for CVE-2026-15579, an out-of-bounds write scored 8.8 on CVSS v4.0 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N.
The root cause is stated plainly: improper validation of the username field length during web login processing. An unauthenticated attacker submits an overly long string, the buffer overflows, and the authentication process crashes. The weakness class is CWE-787. Firmware v2.0 and earlier are affected; v2.1 and later fix it. The finder was Mask Lu.
The product is the TN-4500B series, Moxa's EN 50155 rail-rated managed switch family — the switches that go into rolling stock and trackside cabinets. That is what makes this more interesting than the score suggests.
Consider the failure mode. The switch keeps forwarding traffic; what dies is the ability to log in and look at it. Nothing stops, nothing derails, but the network becomes opaque to whoever is trying to diagnose a fault, and it stays that way until the unit is restarted. On a vehicle in service, that is a degraded but running system with no visibility, which is an uncomfortable state to be in.
Then consider the fix. Firmware v2.1 on a fleet of vehicles means a depot visit per vehicle, scheduled around service patterns, with whatever testing the operator's change process demands. Moxa's interim mitigations are the standard set: restrict network access through firewalls, use multi-factor authentication, minimise service exposure, keep firmware current, enable logging and monitoring. On a train, most of those are decisions made years earlier, at design.